APT28 Archives - Recon Bee

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

6Mar

By RBNo Comments

News

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

Cybersecurity experts have revealed information on a recent Russian cyberattack that used the previously unidentified malware families BadPaw and MeowMeow to target Ukrainian organizations. A phishing email with a link to a ZIP archive starts the attack chain. According to a research released this week by ClearSky, once extracted, an initial HTA file shows a lure document written in Ukrainian on border crossing requests to trick the victim. The attack chain also results in the deployment of BadPaw, a.NET-based loader that communicates with a distant server to retrieve and launch MeowMeow, a sophisticated backdoor. Based on the targeting footprint, the geopolitical nature of the lures utilized, and similarities to methods seen in earlier Russian cyber operations, the campaign has ...

APT28 Targeted European Entities Using Webhook-Based Macro Malware

24Feb

By RBNo Comments

News

APT28 Targeted European Entities Using Webhook-Based Macro Malware

APT28, a state-sponsored threat actor associated with Russia, has been linked to a recent campaign that targets particular organizations in Western and Central Europe. The LAB52 threat intelligence team of S2 Grupo reports that the action took place between September 2025 and January 2026. "The campaign relies on basic tooling and the exploitation of legitimate services for infrastructure and data exfiltration," the cybersecurity firm stated, referring to it by the codename Operation MacroMaze. To disseminate lure documents with a common structural element in their XML, a field called "INCLUDEPICTURE" that leads to a webhook[.]site URL that stores a JPG picture, the attack chains use spear-phishing emails as a starting point. Consequently, when the document is opened, the image file...

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

3Feb

By RBNo Comments

News

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

Attacks using a recently revealed Microsoft Office security vulnerability have been linked to the Russia-affiliated state-sponsored threat actor APT28 (also known as UAC-0001) as part of a campaign called Operation Neusploit. Three days after Microsoft made the bug public, on January 29, 2026, Zscaler ThreatLabz reported that it saw the hacker organization using the vulnerability as a weapon in assaults against people in Romania, Slovakia, and Ukraine. CVE-2026-21509 (CVSS score: 7.8) is a Microsoft Office security feature bypass vulnerability that could enable an unauthorized attacker to deliver a specially designed Office file and cause it to activate. According to security experts Sudeep Singh and Roy Tay, social engineering lures were created in both English and localized lan...

Kremlin-Backed APT28 Targets Polish Institutions in Large-Scale Malware Campaign

10May

By RBNo Comments

News

Kremlin-Backed APT28 Targets Polish Institutions in Large-Scale Malware Campaign

APT28, a nation-state actor with ties to Russia, is behind a widespread malware campaign that has attacked Polish government institutions. The computer emergency response team, CERT Polska, stated in a report on Wednesday that the campaign used emails with content meant to pique the recipient's curiosity and get him to click on the link. In an attempt to avoid detection, clicking on the link takes the victim to the domain run.mocky[.]io, which is then used to redirect to another genuine website called webhook[.]site. This free service enables developers to inspect data that's being supplied via a webhook. Using the webhook[.]site, download a ZIP archive file containing the Windows Calculator binary, which is posing as a JPG image file read more Kremlin Backed APT28 Targets Polish...

Microsoft Outlook Flaw Exploited by Russia’s APT28 to Hack Czech, German Entities

6May

By RBNo Comments

News

Microsoft Outlook Flaw Exploited by Russia’s APT28 to Hack Czech, German Entities

The European Union (EU), NATO, the United Kingdom, and the United States denounced Czechia and Germany's disclosure on Friday that they were the subject of a protracted cyber espionage campaign by the nation-state actor known as APT28, which has ties to Russia. A security hole in Microsoft Outlook that was discovered early last year was used to attack certain unidentified businesses in the Czech Republic, according to a statement from the Ministry of Foreign Affairs (MFA) of the Czech Republic. According to the MFA, cyberattacks that target state institutions, political organizations, and vital infrastructure not only endanger national security but also sabotage the democratic processes that underpin our free society read more Microsoft Outlook Flaw Exploited by Russia's APT28 to Ha...

Russia’s APT28 Exploited Windows Print Spooler Flaw to Deploy ‘GooseEgg’ Malware

23Apr

By RBNo Comments

News

Russia’s APT28 Exploited Windows Print Spooler Flaw to Deploy ‘GooseEgg’ Malware

The nation-state threat actor with ties to Russia, identified as APT28, used a Microsoft Windows Print Spooler component security hole to distribute GooseEgg, a previously unidentified bespoke virus. According to reports, the post-compromise tool was in use as early as April 2019 and may have been in use since June 2020. It took advantage of a vulnerability that has since been fixed that allowed for privilege escalation (CVE-2022-38028, CVSS score: 7.8). Microsoft fixed it in upgrades that were made available in October 2022, and the National Security Agency (NSA) of the United States is credited with first bringing attention to the issue at that time. APT28, also known as Fancy Bear and Forest Blizzard (formerly Strontium), weaponized the bug in attacks against government, non-g...