Operation PRISMEX: APT28 Strikes Ukraine and NATO Allies with Steganography, Zero-Days and Logistics Sabotage

On April 8, 2026, researchers from Zscaler ThreatLabz and Google Threat Intelligence Group published their complete analysis of an APT28 campaign that represents one of the most sophisticated Russian cyber-espionage operations ever documented against Europe. Dubbed Operation PRISMEX, the campaign has been active since at least September 2025 and combines zero-day exploitation, novel malware with advanced steganography, abuse of legitimate cloud services for command and control (C2), and surgical targeting that goes well beyond classic espionage: rail logistics in Poland, maritime transport in Romania and Slovenia, weather services in Ukraine, NATO partners involved in ammunition supply initiatives in Slovakia and Czech Republic. This is not just intelligence — it is battlefield preparation for destructive operations.

Who Is APT28 and Why It Is the GRU's Cyber Arm

APT28 — also known as Forest Blizzard, Fancy Bear, Pawn Storm, Sofacy, Sednit, and STRONTIUM — is the cyber unit of Russian military intelligence (GRU, Unit 26165). Active since 2004, it is responsible for some of the most impactful cyber operations in recent history: the DNC hack (2016), the German Bundestag attack (2015), the WADA breach, and the TV5Monde attack in France. Since 2022, with Russia's invasion of Ukraine, APT28 has dramatically intensified operations against Kyiv and its allies, shifting from pure espionage to campaigns with integrated destructive components.

Zero-Day CVE-2026-21509: Weaponized Before the Patch

PRISMEX's initial access vector is exploitation of CVE-2026-21509 in Microsoft Office — a critical flaw (CVSS 7.8) in RTF file handling that enables remote code execution through loading a COM object (Shell.Explorer.1) that should be blocked. Microsoft released an emergency out-of-band patch on January 26, 2026, and CISA immediately added the vulnerability to the KEV catalog with a February 16, 2026 remediation deadline.

The most alarming detail is the timeline: APT28's attack infrastructure was already operational on January 12, 2026 — exactly two weeks before the vulnerability's public disclosure. This means the GRU had the zero-day before Microsoft knew about it, or developed the exploit with remarkable speed. Either way, it demonstrates top-tier offensive capabilities. The campaign also exploited CVE-2026-21513, another recently disclosed vulnerability.

Targets: From Military Logistics to Weather Services

PRISMEX targeting reveals Russian strategy with crystal clarity. In Ukraine: central government executive bodies, hydrometeorology services (weather forecasts — critical for military planning), defense sector, and emergency services. In Poland: rail logistics — the main land corridor for military equipment transport to Ukraine. In Romania, Slovenia, and Turkey: maritime transport and transportation infrastructure. In Slovakia and Czech Republic: logistics partners involved in ammunition supply initiatives for Ukraine.

This targeting pattern maps the entire logistics chain of Western support to Ukraine. Polish railways, Romanian ports, Ukrainian weather services, Czech and Slovak ammunition suppliers — every node of the military supply chain is under surveillance. The presence of destructive capabilities alongside espionage tools indicates the GRU is preparing the ability to disrupt weapons, ammunition, and logistics flows to Ukraine through cyber attacks.

• Ukraine: central executive bodies, hydrometeorology, defense, emergency services
• Poland: rail logistics — main corridor for military supplies to Kyiv
• Romania, Slovenia, Turkey: maritime transport and transportation infrastructure
• Slovakia, Czech Republic: partners in ammunition supply initiatives
• NATO partners: military and logistics support organizations

Technical Anatomy: MiniDoor, PixyNetLoader and the PRISMEX Suite

The infection chain begins with weaponized RTF documents exploiting CVE-2026-21509. Social engineering lures are localized in target country languages: Ukrainian, Romanian, Slovak, Polish. After exploitation, the campaign splits into two distinct paths.

The first path deploys MiniDoor — a stripped-down variant of the NotDoor backdoor (attributed to APT28 by Lab52 in September 2025). MiniDoor is a malicious VBA project for Microsoft Outlook that modifies Windows registry settings to weaken Outlook security controls, enabling silent collection and exfiltration of victim emails. The second path deploys the full PRISMEX suite, starting with PixyNetLoader — a proxy DLL that extracts the second-stage .NET payload from a PNG image using a proprietary "Bit Plane Round Robin" steganography algorithm, executing entirely in memory.

Covenant Grunt and C2 via Filen API: Cloud Abuse

The final component is a Covenant Grunt implant communicating through the Filen API — an end-to-end encrypted cloud storage service. This makes C2 traffic practically indistinguishable from normal enterprise cloud traffic. Sekoia previously documented Filen API abuse in APT28's Operation Phantom Net Voxel (September 2025), confirming the GRU has permanently adopted this technique. Defenders must move beyond blocking traditional C2 domains to behavioral analysis of cloud service traffic.

From Espionage to Sabotage: The Paradigm Shift

PRISMEX's most significant element is the operational paradigm shift it represents. Historically, APT28 campaigns against Europe focused on espionage. PRISMEX marks the transition to a dual model: espionage and pre-positioning for destructive actions. Combined with Sandworm's ongoing attacks on European electrical grids and Ukrainian energy infrastructure, the two GRU units now cover the entire spectrum of critical infrastructure needed for the war effort.

MITRE ATT&CK TTPs and IOCs

• T1190 (Exploit Public-Facing Application): CVE-2026-21509 and CVE-2026-21513 exploitation
• T1566.001 (Spearphishing Attachment): weaponized RTF documents with localized lures
• T1559.001 (COM Hijacking): persistence via COM registry manipulation in explorer.exe
• T1574.002 (DLL Side-Loading/Proxying): EhStoreShell.dll as legitimate DLL proxy
• T1027.003 (Steganography): payloads hidden in PNG images with Bit Plane Round Robin
• T1567 (Exfiltration Over Web Service): C2 via Filen API (E2E encrypted cloud storage)
• T1053.005 (Scheduled Task): "OneDriveHealth" task for persistence and cleanup
• T1114 (Email Collection): MiniDoor steals email via malicious Outlook VBA project

Operational Recommendations

1. 1.Immediate CVE-2026-21509 patching: update all Microsoft Office installations. Office 2021/LTSC 2024/Microsoft 365 are auto-protected. Office 2016 requires manual KB5002713.
2. 2.COM hijacking monitoring: check HKCU\Software\Classes\CLSID registry keys for suspicious COM objects, particularly Shell.Explorer.1.
3. 3.PixyNetLoader detection: search for EhStoreShell.dll in %programdata%\USOPublic\Data\User\ and the "OneDriveHealth" scheduled task.
4. 4.Cloud traffic analysis: implement visibility into Filen (filen.io) traffic. C2 via cloud APIs requires behavioral analysis, not just domain blocking.
5. 5.Email protection: monitor Outlook VBA projects for unauthorized modifications. MiniDoor operates as a malicious VBA project.
6. 6.Logistics segmentation: organizations in military supply chains must implement enhanced network segmentation.
7. 7.Threat hunting with PRISMEX IOCs: use indicators from Zscaler ThreatLabz and Google GTIG.
8. 8.Targeted anti-phishing training: staff at logistics, transport, and government organizations need specific training on APT28's localized RTF lures.

Conclusion: The GRU Is Preparing the Digital Battlefield

Operation PRISMEX demonstrates the GRU has made the qualitative leap from digital espionage to preparing sabotage operations against the NATO logistics chain. The combination of zero-days weaponized before patching, advanced steganography, legitimate cloud service abuse, and surgical military supply chain targeting represents the highest level of state-sponsored cyber threat Europe has faced since 2022. The lesson is brutal in its simplicity: every organization touching the Ukraine support logistics chain is already in the GRU's crosshairs.