APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies

APT28 deployed PRISMEX malware suite using advanced steganography, COM hijacking, and cloud service abuse for C2. The campaign uses a two-stage attack chain combining CVE-2026-21513 and CVE-2026-21509. PRISMEX components include: PrismexSheet (Excel dropper with VBA macros using steganography), PrismexDrop (native dropper using scheduled tasks and COM DLL hijacking), PrismexLoader (proxy DLL extracting .NET payload from PNG images using Bit Plane Round Robin algorithm), and PrismexStager (COVENANT Grunt implant abusing Filen.io cloud storage). The malware can perform both espionage and destructive operations, including a wiper command that erases files under %USERPROFILE% directory.