APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies
APT28 (also known as Forest Blizzard and Pawn Storm), a Russian threat actor, has been connected to a new spear-phishing campaign that targets Ukraine and its allies in order to install a malware suite called PRISMEX that has never been documented.
According to a technical paper by Trend Micro experts Feike Hacquebord and Hiroyuki Kakara, PRISMEX combines advanced steganography, component object model (COM) hijacking, and lawful cloud service exploitation for command-and-control. It is thought that the campaign has been going on since at least September 2025.
Central executive bodies, hydrometeorology, defense, emergency services, rail logistics (Poland), maritime and transportation (Romania, Slovenia, Turkey), logistical support partners involved in ammunition initiatives (Slovakia...