A Russian cyber espionage group, APT28 (also Forest Blizzard and Pawn Storm), is reportedly conducting spear-phishing attacks against Ukraine and its allies, using a newly discovered malware family called PRISMEX.

According to Trend Micro researchers, PRISMEX employs advanced data hiding techniques, takes advantage of COM hijacking, and uses legitimate cloud services for its command infrastructure. The campaign is thought to have begun around September 2025.

The attacks have focused on different parts of the Ukrainian government, including administrative bodies, weather services, defense, and emergency response, in addition to rail transportation in Poland, maritime shipping in Romania, Slovenia, and Turkey, and logistic support companies involved in ammunition programs in Slovakia and the Czech Republic, as well as armed forces and NATO allies.

The campaign is noteworthy for quickly utilizing recently revealed security vulnerabilities like CVE-2026-21509 and CVE-2026-21513, to breach targets. Initial preparations were seen on January 12, 2026, just two weeks prior to the public disclosure of CVE-2026-21509.

In late February 2025, Akamai revealed that APT28 possibly utilized CVE-2026-21513 as a zero-day exploit. It involved a malicious Microsoft Shortcut (LNK) file uploaded to VirusTotal on January 30, 2026, before Microsoft released a patch on February 10, 2026.

This zero-day exploit pattern indicates that the threat actor was aware of these weaknesses before Microsoft made them public.

A common domain, “wellnesscaremed[.]com,” was found across campaigns involving the exploitation of both weaknesses. This shared element, as well as the timing of the two exploits, suggest a deliberate connection, implying the attackers might be combining CVE-2026-21513 and CVE-2026-21509 for a more sophisticated staged attack.

Trend Micro suggests that the initial vulnerability (CVE-2026-21509) forces the victim’s machine to retrieve a malicious .LNK file, which is then used to exploit the second vulnerability (CVE-2026-21513) to circumvent security measures and run malicious code without any prompts.

The attacks finish with the deployment of MiniDoor, an email password stealer specifically for Outlook, or a set of related malware components known as PRISMEX, that uses steganography to hide payloads in image files. These consist of –

• PrismexSheet: A malicious Excel file containing VBA macros that extracts hidden payloads using steganography, ensures persistence via COM hijacking, and displays a decoy involving drone inventory lists after enabling macros.
• PrismexDrop: A native dropper that prepares the environment for subsequent exploits and uses scheduled tasks and COM DLL hijacking to maintain persistence.
• PrismexLoader (PixyNetLoader): A proxy DLL that extracts the .NET payload, which is scattered across a PNG image (“SplashScreen.png”), using a “Bit Plane Round Robin” algorithm and runs it in memory.
• PrismexStager: A COVENANT Grunt component that uses Filen.io cloud storage for C2 communications.

It’s important to note that Zscaler ThreatLabz previously documented aspects of this campaign under the name Operation Neusploit.

The Computer Emergency Response Team of Ukraine (CERT-UA) reported APT28’s use of COVENANT, a open-source C2 framework, back in June 2025. PrismexStager is believed to be an updated version of MiniDoor and NotDoor (GONEPOSTAL), a Microsoft Outlook backdoor deployed by the group during late 2025.

In at least one case in October 2025, the COVENANT Grunt payload was used not just for gathering intelligence, but also to execute a devastating command that deletes all files under the “%USERPROFILE%” directory. This suggests that these attacks may be designed for both spying and sabotage.

According to Trend Micro, this operation shows that Pawn Storm is still one of the most active cyber intrusion groups linked to Russia, and the choice of targets shows an intention to compromise Ukraine’s supply chain and operational planning capabilities, as well as those of its NATO partners.

The concentration on critical areas like the supply chain, weather services, and humanitarian aid routes for Ukraine points to a shift towards disrupting operations, hinting at more destructive activity in the future.