[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feZbz4HHiZuabZF9E5OKfd31CpCtavwq6qeBSknWPaGM":3},{"article":4,"iocs":56,"watch_terms":86,"solutions":87,"lesson":35},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"8a1f0c5b-694b-45f1-b940-583da2910e5e","APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies","apt28-deploys-prismex-malware-in-campaign-targeting-ukraine-and-nato-allies-6b414d","The Russian threat actor known as APT28 (aka Forest Blizzard and Pawn Storm) has been linked to a fresh spear-phishing campaign targeting Ukraine and its allies to deploy a previously undocumented malware suite codenamed PRISMEX. \"PRISMEX combines advanced steganography, component object model (COM) hijacking, and legitimate cloud service abuse for command-and-control,\" Trend Micro","APT28 is deploying the PRISMEX malware suite in a spear-phishing campaign targeting Ukraine and its allies. The campaign, active since at least September 2025, exploits vulnerabilities like CVE-2026-21509 and CVE-2026-21513 to deploy MiniDoor or PRISMEX, which uses steganography and cloud services for C2.","APT28 targets Ukraine and NATO allies with PRISMEX malware in spear-phishing campaign.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fapt28-deploys-prismex-malware-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhBiilqDko4PDmo2Iu-E-25PRzUJ2LygbHdv1RsdA31AkJBL9QB3AzdxV_4j-jo2Xf9wXwlienf17HO_uJyiue3JOWNfTFdln4gXJcounilzPxOsIXpN5g6imDW3ta0jt4Ck3UYinAmWwHZqfxYhjuaFnOIowTmZbNedv3AmS7Qlze1-tD2gkJBuUxTzSml\u002Fs1600\u002Fnato.jpg","2026-04-08T13:50:00+00:00","2026-04-08T16:01:09.042645+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"APT28","threat_actor",{"name":21,"type":19},"Forest Blizzard",{"name":23,"type":19},"Pawn Storm",{"name":25,"type":26},"Operation Neusploit","campaign",{"name":28,"type":29},"Outlook","product",{"name":31,"type":32},"COVENANT","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,65,68,71,74,77,80,83],{"type":58,"value":59,"context":60},"domain","wellnesscaremed[.]com","Used in campaigns exploiting CVE-2026-21513 and CVE-2026-21509",{"type":62,"value":63,"context":64},"cve","CVE-2026-21509","Exploited to retrieve a malicious .LNK file",{"type":62,"value":66,"context":67},"CVE-2026-21513","Exploited to bypass security features and execute payloads",{"type":50,"value":69,"context":70},"MiniDoor","Outlook email stealer deployed by APT28",{"type":50,"value":72,"context":73},"PRISMEX","Malware suite using steganography and cloud services for C2",{"type":50,"value":75,"context":76},"PrismexSheet","Malicious Excel dropper",{"type":50,"value":78,"context":79},"PrismexDrop","Native dropper",{"type":50,"value":81,"context":82},"PrismexLoader","Proxy DLL",{"type":50,"value":84,"context":85},"PrismexStager","COVENANT Grunt implant",[],{"controls":88,"vendors":175},[89,117,146],{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":90,"product_name":114,"url":115,"description":116},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":147,"name":148,"problem":149,"products":150},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[151,159,167],{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":168,"vendor_name":169,"vendor_logo":170,"product_slug":171,"product_name":172,"url":173,"description":174},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[176,182],{"slug":177,"name":178,"logo_path":179,"roles":180},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png",[181],"reported_by",{"slug":183,"name":184,"logo_path":185,"roles":186},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[187],"affected"]