APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies
APT28 targets Ukraine and NATO allies with PRISMEX malware in spear-phishing campaign.
APT28 is deploying the PRISMEX malware suite in a spear-phishing campaign targeting Ukraine and its allies. The campaign, active since at least September 2025, exploits vulnerabilities like CVE-2026-21509 and CVE-2026-21513 to deploy MiniDoor or PRISMEX, which uses steganography and cloud services for C2.
AI summary of the linked source. Not reviewed by an editor. How this works
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — wellnesscaremed[.]com
- cve — CVE-2026-21509
- cve — CVE-2026-21513
- malware — MiniDoor
- malware — PRISMEX
- malware — PrismexSheet
- malware — PrismexDrop
- malware — PrismexLoader
- malware — PrismexStager