In a campaign codenamed Operation MacroMaze(active September 2025 – January 2026), the Russian-linked threat actor APT28 (also known as Fancy Bear) targeted entities in Western and Central Europe using a novel webhook-based beaconing and malware delivery system.

Key Campaign Details

• Attack Mechanism: The campaign utilized spear-phishing emails containing lure documents. These documents embedded an INCLUDEPICTURE field within their XML structure pointing to a Webhook.site URL.
• Beaconing: When a victim opens the document, Microsoft Word automatically fetches a remote image from the webhook URL. This acts as a “tracking pixel,” allowing attackers to log metadata (IP address, user agent) and confirm the document was opened.
• Macro Variants: Researchers identified four macro variants that functioned as droppers. These macros wrote six different malicious files (including .vbs, .bat, and .cmd components) into the %USERPROFILE% directory using GUID-like filenames.
• Infrastructure Abuse: APT28 leveraged legitimate web services to blend malicious traffic with normal network activity, making detection by traditional security tools more difficult.

Context & Concurrent Activity

This operation is part of a broader surge in APT28 activity across Europe in early 2026:

• Rapid Exploitation: The group has been observed weaponizing the CVE-2026-21509 Microsoft Office Vulnerability within 24 hours of its disclosure to target European military, government, and maritime organizations.
• Targeted Sectors: Recent targets include energy and nuclear agency staff in Turkey, European think tanks, and logistics providers.
• New Tooling: Alongside Operation MacroMaze, APT28 has deployed other new malware like NotDoor (an Outlook-based backdoor) and LAMEHUG (which incorporates Large Language Model capabilities).