APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies

APT28 (Forest Blizzard/Pawn Storm) has deployed a previously undocumented malware suite called PRISMEX in a spear-phishing campaign targeting Ukraine and NATO allies, active since at least September 2025.

• •PRISMEX combines steganography, COM hijacking, and legitimate cloud service abuse (Filen.io) for command-and-control
• •Targeted sectors include Ukrainian defense, hydrometeorology, emergency services, and NATO supply chain partners across Poland, Romania, Slovakia, Czech Republic, and Turkey
• •APT28 exploited zero-days CVE-2026-21509 and CVE-2026-21513 in a two-stage chain, with infrastructure prepared two weeks before the first CVE was publicly disclosed
• •PRISMEX components include PrismexSheet (Excel VBA dropper), PrismexDrop (native dropper), PrismexLoader (proxy DLL using a bespoke Bit Plane Round Robin steganography algorithm), and PrismexStager (COVENANT Grunt implant)