APT28 Hides Its Implants in PNGs and Rebuilds the Loader Every Few Weeks
ExaTrack tracked about 90 samples of PixyNetLoader, an APT28 loader that pulls a Covenant implant out of PNG pixels and talks to its operators through the Filen cloud service.
APT28 has spent two years hiding its implants inside ordinary-looking PNG images, and it rebuilds the loader that unpacks them every few weeks. That’s the finding of a June 2026 report from French firm ExaTrack, which tracked about 90 samples of a loader it calls PixyNetLoader across roughly 23 versions, from April 2024 to April 2026. ExaTrack attributes the family to Russia’s APT28 and ties it to the early-2026 Microsoft Office exploit campaign CERT-UA reported against Ukraine and EU targets.
For defenders
The chain, per ExaTrack: a booby-trapped DOC or XLS file exploits CVE-2026-21509 in Microsoft Office (T1203 (Exploitation for Client Execution)) and runs a small dropper. The dropper installs the PixyNetLoader DLL plus a companion PNG, and registers the DLL by hijacking a COM class so Windows loads it for them (T1546.015 (Event Triggered Execution: Component Object Model Hijacking)). The loader pulls an encrypted payload out of the image’s pixel data (T1027.003 (Obfuscated Files or Information: Steganography)), decrypts it with AES and runs it in memory. The payload is a Covenant Grunt implant that talks to its operators through the Filen cloud storage service (T1102 (Web Service)).
Why it’s catchable: ExaTrack splits the samples into four sub-families and says the loader DLL itself isn’t encrypted, making it the APT28 component most likely to be spotted on disk. Builds are compiled often and used soon after. The report publishes YARA rules, including one meant to match every version, plus hunting profiles (64-bit C++ DLL under 800 KB, bad checksums and timestamps, “Microsoft” company name).
Not disclosed: specific victims. ExaTrack gives no domains or IP addresses; the only C2 is Filen, a legitimate service.
%programdata%\Microsoft OneDrive\setup\Cache\SplashScreen.png
%programdata%\Microsoft\DeviceSync\EdgeSync\EdgeLogo.png
%public%\pictures\WordIllustration.png
%LocalAppData%\windows.png
C:\ProgramData\USOShared\Logs\User\svrobj.dll
C:\ProgramData\Microsoft\DeviceSync\EdgeSyncPr.dll
%ALLUSERPROFILE%\usopublic\data\user\ehstoreshell.dll
HKCU\Software\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InProcServer32
HKCU\Software\Classes\CLSID\{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}\InProcServer3252b6fb40e7efb09c2bebe8550178e7e30009600bdedd1acae085d753761b7598 (PixyNetLoader DLL, family A)
87a962c6599176e1806c0ccd1b157d3f80e3ccc288c288d039872d9683da24d9 (XLS decoy)
5fce3647ca4e8bab5d981b73bf2d2dfefb9699e1f898323e8aa0d963cee46583 (PNG companion, family C)
8c1dc9732884c6078b23953b78314a8d0d8b8d9fe42e5f97a7cd09b8ace943a9 (exploit document)ExaTrack’s full list runs to roughly 90 loader hashes and a dozen exploit documents.
What it means for you
This is a spy tool aimed at governments and organizations Russia’s military intelligence cares about, not everyday users. The lesson that carries over is simple: the way in was a Word or Excel attachment exploiting an Office bug Microsoft had already fixed. If you keep Office updated, this particular trick doesn’t work on you.
Do this now
- Make sure Microsoft Office is fully patched for CVE-2026-21509, and turn on automatic updates.
- Security teams: load ExaTrack’s YARA rules and sweep endpoints for the PNG and DLL paths above.
- Alert on new InProcServer32 registry values under HKCU\Software\Classes\CLSID that point into ProgramData or AppData.
- If your organization doesn’t use Filen, block or flag traffic to it.
Source article: Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
Publisher: ExaTrack (no individual author named)
Published: June 1, 2026
URL: https://exatrack.com/publications/apt28-pixynetloader.html
Executive Summary
ExaTrack attributes PixyNetLoader to APT28 (tracked by Trend Micro as Pawn Storm, whose name for the related toolset is PRISMEX; the same loader appears in Sekoia’s Operation Phantom Net Voxel and Zscaler’s Operation Neusploit reporting). It is a 64-bit C++ COM DLL that loads an encrypted payload hidden in the least significant bits of a companion PNG’s pixels and runs it in memory; the payload is a Covenant Grunt implant (version info Publish.exe) that uses the Filen cloud storage service as its command channel. ExaTrack clustered about 90 samples into 23 versions and four sub-families (A, 58a6e3e4, B and C) compiled between 2024 and April 15, 2026, with new builds used very soon after compilation, and ties the January 2026 Family A build 52b6fb40 to the campaign CERT-UA reported in February 2026 against Ukrainian and EU targets. The intrusion chain runs from a malicious DOC or XLS exploiting the Microsoft Office flaw CVE-2026-21509, to a small SimpleDropper stage that writes the loader DLL into a Microsoft-looking folder under ProgramData, AppData or the public profile and registers it under an HKCU CLSID InProcServer32 key, to the loader reading its PNG and decrypting the implant (Family C, from March 13, 2026, adds a PBKDF2-derived AES key and a “HIDE” header). The objective is espionage access to government, defense and related targets; on an infected host the impact is a persistent, memory-resident implant whose traffic blends into a legitimate cloud service. ExaTrack publishes two YARA rules, file-profile hunting criteria and host indicators but no attacker domains or IPs; hunt leads, false positive expectations, the published rule text and indicators are detailed below.
ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Command and Control
Hunt Lead Grid
| Hunt Lead Level | Hunt Lead Name | ATT&CK | Risk of False Positives |
|---|---|---|---|
| 1 (Junior) | PixyNetLoader Companion PNG and DLL Path Sweep | T1036.005 (Masquerading: Match Legitimate Resource Name or Location) | Low. Most of these paths and names don’t exist on a clean Windows install; the risk sits with generic names like windows.png, so anchor on the full path and on a DLL and PNG appearing together. |
| 1 (Junior) | ExaTrack YARA Sweep for PixyNetLoader DLLs | T1027.003 (Obfuscated Files or Information: Steganography) | Low to Medium. The crypto rule is described by ExaTrack as very basic, so a small 64-bit COM DLL could match by chance; a match outside System32 that also claims “Microsoft Corporation” without a valid Microsoft signature is the anchor. |
| 2 (Pro) | HKCU InProcServer32 Pointing Into ProgramData or AppData | T1546.015 (Event Triggered Execution: Component Object Model Hijacking) | Medium. Some per-user software (OneDrive, Teams, sync and shell extensions) registers COM servers under HKCU; the rule anchors on the three CLSIDs ExaTrack names and on unsigned DLLs in user-writable Microsoft-named folders. |
| 3 (Elite) | Office Drops a DLL and PNG Pair, Then Filen Traffic | T1203 (Exploitation for Client Execution), T1102.002 (Web Service: Bidirectional Communication) | High on any single signal, since Office writes files constantly and some people use Filen; the lead only holds when an Office process writes a DLL and a PNG into the same Microsoft-named folder and a non-browser process later talks to Filen. |
PixyNetLoader Companion PNG and DLL Path Sweep
Every PixyNetLoader version reads its payload from a companion PNG at a fixed path compiled into the DLL, and the DLLs are installed under names that imitate Windows components. ExaTrack’s appendix lists the PNG paths %LocalAppData%\windows.png, %programdata%\Microsoft OneDrive\setup\Cache\SplashScreen.png, %programdata%\Microsoft\DeviceSync\EdgeSync\EdgeLogo.png, %programdata%\Microsoft\DeviceSync\EdgeSync\start.png, %public%\pictures\WordIllustration.png, %programdata%\Microsoft\DeviceSync\IID11f5d-97b9-44be-812f-4fd5fd0d6d84\Sample.png, %programdata%\Microsoft\DeviceSync\8acd6e71-bf10-4800-aeee-7de00edc9781\background.png and %programdata%\Microsoft\DeviceSync\UIDD304d-22c6-4f29-801b-58d0685fe77b\Default.png, and the DLL paths %APPDATA%\microsoft\protect\altio32.dll, %ALLUSERPROFILE%\usopublic\data\user\ehstoreshell.dll, C:\ProgramData\prnfldr.dll, C:\ProgramData\Microsoft OneDrive Storage\MimeTypes\Default\mimeobj.dll, C:\ProgramData\USOShared\Logs\User\svrobj.dll, adwapi32.dll and FlightConfig.dll in that same USOShared folder, and C:\ProgramData\Microsoft\DeviceSync\EdgeSyncPr.dll. Internal export names seen across versions are prnfldr.dll, stobject.dll, adwapi32.dll, EhStorShell.dll and EdgeSyncPr.dll. The detection logic is a file-inventory and file-creation search for any of these exact paths, raised to high confidence when a PNG and a DLL from the list appear on the same host within minutes of each other.
Use EDR file-creation events and, for older activity, a live file-system sweep, since the files persist for as long as the implant does. Sweep at least back to December 2024, when Family A starts, or as far as your telemetry reaches; ExaTrack notes builds are used almost as soon as they’re compiled, so a fresh path may appear before any vendor publishes it, which makes the folder patterns (DeviceSync subfolders with GUID-like names, USOShared\Logs\User, a OneDrive “setup\Cache” under ProgramData) worth watching beyond the exact names. Don’t treat windows.png or start.png on their own as a hit; require the full path. Hash-blocking the PNGs is the wrong control because each build ships a new image. Treat any confirmed DLL and PNG pair as an APT28 compromise and escalate to incident response rather than deleting the files, so the PNG can be preserved and decoded with ExaTrack’s published extraction script.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location) (our mapping; the source gives no ATT&CK IDs)
Sources: “Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026”, ExaTrack, June 1, 2026, https://exatrack.com/publications/apt28-pixynetloader.html (source article)
ExaTrack YARA Sweep for PixyNetLoader DLLs
ExaTrack chose the loader DLL as the detection target because it is installed with persistence and, unlike the payload, isn’t encrypted. Function-level comparison showed four string-encryption routines present in almost every sample regardless of sub-family, which became the PixyNetLoaderCrypto rule; a second rule, PixyNetLoader_B_PNG, keys on the IDAT and tIME chunk searches and two CRC32 routines from the PNG-handling code. Both depend on a private DllCom rule: an MZ file under 800 KB exporting at least two of DllRegisterServer, DllCanUnloadNow and DllGetClassObject and importing at least two of GetProcAddress, GetCurrentProcess, CreateMutexW and LoadLibraryW. ExaTrack’s file-profile hunting criteria back this up: a 64-bit C++ DLL, patched (bad) checksums and timestamps, CRC32 code, a “Microsoft Corporation” company name in version info and a compile timestamp that isn’t a Microsoft build ID. The detection logic is to run both rules across endpoint file collections, sandbox detonations and email attachment stores, then confirm hits against the profile.
Run the rules with an endpoint YARA scanner or your EDR’s YARA feature over ProgramData, AppData and Users\Public first, then system-wide, and retro-hunt on any malware repository you have access to. The DllCom condition alone matches countless legitimate COM DLLs, so never deploy it on its own; it exists only as a building block. Expect the crypto rule to be the broader one: ExaTrack says it is basic but functional, so validate hits by checking for an invalid or missing signature on a file that claims to be Microsoft. Family C, from March 2026, is barely detected by antivirus engines (one sample hit two engines), so a YARA match is likely to be your first signal rather than a duplicate of an AV alert. A confirmed match is an incident, not a tuning task.
private rule DllCom {
strings:
$com_01 = "DllRegisterServer"
$com_02 = "DllCanUnloadNow"
$com_03 = "DllGetClassObject"
$str_01 = "GetProcAddress"
$str_02 = "GetCurrentProcess"
$str_03 = "CreateMutexW"
$str_04 = "LoadLibraryW"
condition:
uint16be(0) == 0x4d5a and 2 of ($com_*) and 2 of ($str_*) and filesize < 800KB
}
rule PixyNetLoader_B_PNG {
meta:
author = "Exatrack"
date = "2026-05-25"
description = "PixyNetLoader PNG functions"
score = 90
tlp = "GREEN"
sample_hash = "52b6fb40e7efb09c2bebe8550178e7e30009600bdedd1acae085d753761b7598"
strings:
$png_search_idat = { 80 7B 04 49 75 ?? 80 7B 05 44 75 ?? 80 7B 06 41 75 ?? 80 7B 07 54 75 ?? }
$png_search_tIME = { 80 7B 04 74 75 ?? 80 7B 05 49 75 ?? 80 7B 06 4D 75 ?? 80 7B 07 45 75 ?? }
$crc32_1 = { 0F B6 11 33 ?? C1 E2 08 44 8B ?? 0B D0 0F B6 41 02 C1 E2 08 0B D0 }
$crc32_2 = { 8B C1 48 33 D0 C1 E9 08 44 0F B6 C2 49 FF C1 }
condition:
DllCom and all of ($png_*) and all of ($crc32_*)
}rule PixyNetLoaderCrypto {
meta:
author = "Exatrack"
date = "2026-05-25"
description = "PixyNetLoader crypto strings functions"
score = 90
tlp = "GREEN"
sample_hash = "52b6fb40e7efb09c2bebe8550178e7e30009600bdedd1acae085d753761b7598"
strings:
$pattern1_01 = { 0FB6??243841B?010000008BC?418BC?D2E0B908000000 }
$pattern1_02 = { 410FB6C34503C02407B9070000002AC8498BC348C1E80349FFC3 }
$pattern2_01 = { 4488024C8BC30FB657023217 }
$pattern2_02 = { 418850014C8BC30FB65703321748837B180F }
$pattern3_01 = { 0FB6C8D2EA4132D0F6C201 }
$pattern3_02 = { D2EA410FB6C0D0E832D0F6C201 }
$pattern3_03 = { 0FB6C8D2EA410FB6C0C0E80332D0F6C201 }
condition:
(all of ($pattern1_*) or all of ($pattern2_*) or all of ($pattern3_*)) and DllCom
}Rules reproduced as published in the source article (PixyNetLoaderCrypto needs the DllCom private rule from the first block in the same file).
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Defense Evasion → T1027.003 (Obfuscated Files or Information: Steganography) (our mapping for the loader whose code the rules match; the source gives no ATT&CK IDs)
Sources: “Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026”, ExaTrack, June 1, 2026, https://exatrack.com/publications/apt28-pixynetloader.html (source article; rule text and hunting profile)
HKCU InProcServer32 Pointing Into ProgramData or AppData
PixyNetLoader persists by COM hijacking: the dropper writes the loader’s path as the default value of an InProcServer32 key under the current user’s Classes\CLSID hive, so that when Windows or Explorer instantiates that class, the per-user registration wins over the machine-wide one and the loader DLL is loaded into a legitimate process. ExaTrack lists three CLSIDs used (and says the list isn’t exhaustive): {68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}, {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} and {2227A280-3AEA-1069-A2DE-08002B30309D}. The last is a standard Windows shell class, which is exactly why hijacking it works. The detection logic is any creation or modification of HKCU\Software\Classes\CLSID\{…}\InProcServer32 whose value points to a DLL in ProgramData, AppData or Users\Public, with an immediate alert for the three named CLSIDs and for any of the DLL paths from the first lead.
Use EDR registry telemetry or Sysmon Event IDs 12 and 13 on HKCU and HKU\*\Software\Classes\CLSID, plus a one-time sweep of every loaded user hive for existing InProcServer32 values, because persistence written long ago won’t show up as a fresh event. Legitimate per-user COM registrations exist (OneDrive, Teams, some shell extensions and sync clients), so baseline them and allowlist by the signed DLL path and publisher rather than by CLSID or file name, which PixyNetLoader deliberately imitates. Pair a hit with an image-load event of the same DLL into explorer.exe or another long-lived process to confirm it’s live. Deleting the key without preserving the DLL and PNG loses the evidence; collect first, then remediate. This lead generalizes to COM-hijack persistence used by many other families.
Hunt Lead Level: 2 (Pro)
ATT&CK: Persistence → T1546.015 (Event Triggered Execution: Component Object Model Hijacking); Defense Evasion → T1112 (Modify Registry) (our mapping; the source gives no ATT&CK IDs)
Sources: “Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026”, ExaTrack, June 1, 2026, https://exatrack.com/publications/apt28-pixynetloader.html (source article)
Office Drops a DLL and PNG Pair, Then Filen Traffic
The delivery step is a DOC or XLS that exploits CVE-2026-21509 in Microsoft Office and runs a SimpleDropper stage; that stage writes the PixyNetLoader DLL and its PNG and sets up the COM key. ExaTrack lists a dozen exploit documents, each mapped to the loader build it drops, and shows a Family C build packaged inside a decoy XLS. Once loaded, the loader decrypts a Covenant Grunt implant from the PNG and runs it from memory, and that implant uses Filen cloud storage for command and control. The detection logic correlates three stages on one host: an Office process (winword.exe or excel.exe, or a child it spawned) creating a DLL and a PNG in the same ProgramData, AppData or Users\Public subfolder; an HKCU InProcServer32 write pointing at that DLL; and later, outbound connections to Filen’s service from a process that isn’t a browser or the Filen client, such as explorer.exe or another process the hijacked class loads into.
Join EDR process, file and registry events with DNS or proxy logs that carry process attribution. Office writes temporary files all the time, so the anchor is the file type pair (a PE DLL and a PNG) landing in a Microsoft-named folder outside Office’s own cache locations, not the write itself. Filen is a legitimate end-to-end encrypted storage service: where nobody in the organization uses it, blocking or alerting on it is reasonable, but where people do, allowlist the Filen desktop client and browsers by signed image path and alert on everything else. Content inspection won’t help because Filen traffic is encrypted, which is the point of using it. Sweep 90 days and patch Office for CVE-2026-21509 regardless. Any full sequence is a confirmed intrusion; isolate the host and hand it to incident response.
Hunt Lead Level: 3 (Elite)
ATT&CK: Execution → T1203 (Exploitation for Client Execution); Command and Control → T1102.002 (Web Service: Bidirectional Communication) (our mapping; the source gives no ATT&CK IDs)
Sources: “Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026”, ExaTrack, June 1, 2026, https://exatrack.com/publications/apt28-pixynetloader.html (source article)
Hash Appendix
PixyNetLoader DLLs (selected builds)
SHA-256 values come from the source article; the MD5 and SHA-1 for 52b6fb40 and the SHA-1 for c6f13923 were sourced via OTX AlienVault; OTX gave no MD5 for the others. ExaTrack’s appendix lists about 90 loader hashes in total.
MD5s
4423b8f3456e54eb48dfbde0b4c7984b # 52b6fb40 -> PixyNetLoader Family A (EhStorShell.dll, compiled 2026-01-21, CERT-UA campaign) (sourced via OTX)
(not available) # a876f648 -> PixyNetLoader Family A (EhStorShell.dll, 2026-01-23)
(not available) # 7acb7ed2 -> PixyNetLoader Family A (EhStorShell.dll, 2026-01-23)
(not available) # ab681611 -> PixyNetLoader Family B (EdgeSyncPr.dll, 2026-02-10)
(not available) # c6f13923 -> PixyNetLoader Family C (EdgeSyncPr.dll, 2026-04-15)
(not available) # a5729b6e -> PixyNetLoader Family C (barely detected sample)SHA1s
e55cacbbff9ad573cbaddf8a59bac187bf8c78f3 # 52b6fb40 -> PixyNetLoader Family A (EhStorShell.dll, compiled 2026-01-21, CERT-UA campaign) (sourced via OTX)
(not available) # a876f648 -> PixyNetLoader Family A (EhStorShell.dll, 2026-01-23)
(not available) # 7acb7ed2 -> PixyNetLoader Family A (EhStorShell.dll, 2026-01-23)
(not available) # ab681611 -> PixyNetLoader Family B (EdgeSyncPr.dll, 2026-02-10)
e457641615b548c315913fac7e8255519e50687f # c6f13923 -> PixyNetLoader Family C (EdgeSyncPr.dll, 2026-04-15) (sourced via OTX)
(not available) # a5729b6e -> PixyNetLoader Family C (barely detected sample)SHA256s
52b6fb40e7efb09c2bebe8550178e7e30009600bdedd1acae085d753761b7598 # 52b6fb40 -> PixyNetLoader Family A (EhStorShell.dll, compiled 2026-01-21, CERT-UA campaign)
a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1 # a876f648 -> PixyNetLoader Family A (EhStorShell.dll, 2026-01-23)
7acb7ed2c8609d235d356a17058684fcf39beaa492f1369897ceeb7b71f5ff0a # 7acb7ed2 -> PixyNetLoader Family A (EhStorShell.dll, 2026-01-23)
ab68161147a5436b262afd7ecfeda4cc1d42598115b638dd98d6f105fcf2a534 # ab681611 -> PixyNetLoader Family B (EdgeSyncPr.dll, 2026-02-10)
c6f13923f1310433b6271096957e71943543b7e41522367e4e855e653bf1c5a5 # c6f13923 -> PixyNetLoader Family C (EdgeSyncPr.dll, 2026-04-15)
a5729b6e36c0ab4798db5004700a1fe843f4d1b0811023c47b7b2972befb6360 # a5729b6e -> PixyNetLoader Family C (barely detected sample)Companion PNG and exploit documents
SHA-256 values come from the source article; the SHA-1 for 8c1dc973 was sourced via OTX AlienVault and its MD5 comes from CERT-UA#19542 (additional source, same campaign); no other MD5s were found.
MD5s
(not available) # 5fce3647 -> PNG companion holding the Family C payload
(not available) # 87a962c6 -> decoy XLS that drops Family C
744bbe8d7c3d0421fa0deb582481f5ba # 8c1dc973 -> CVE-2026-21509 exploit DOC, drops 52b6fb40 (from CERT-UA#19542, where it is named s.d)
(not available) # 5c2a2c49 -> exploit DOC, drops 7acb7ed2
(not available) # 580cd001 -> exploit document, drops ab681611SHA1s
(not available) # 5fce3647 -> PNG companion holding the Family C payload
(not available) # 87a962c6 -> decoy XLS that drops Family C
7bc3bafa39f61969a577f54bff28c0d1eff75d5c # 8c1dc973 -> CVE-2026-21509 exploit DOC, drops 52b6fb40 (sourced via OTX)
(not available) # 5c2a2c49 -> exploit DOC, drops 7acb7ed2
(not available) # 580cd001 -> exploit document, drops ab681611SHA256s
5fce3647ca4e8bab5d981b73bf2d2dfefb9699e1f898323e8aa0d963cee46583 # 5fce3647 -> PNG companion holding the Family C payload
87a962c6599176e1806c0ccd1b157d3f80e3ccc288c288d039872d9683da24d9 # 87a962c6 -> decoy XLS that drops Family C
8c1dc9732884c6078b23953b78314a8d0d8b8d9fe42e5f97a7cd09b8ace943a9 # 8c1dc973 -> CVE-2026-21509 exploit DOC, drops 52b6fb40
5c2a2c49e200a2d048f477440da75ff4a99c676943f6f7cac1ce70190520f998 # 5c2a2c49 -> exploit DOC, drops 7acb7ed2
580cd001739f95c343c0b3f16ab2c274b54d126e1c35eaf3b7377add37435f22 # 580cd001 -> exploit document, drops ab681611References Appendix
- “Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026”, ExaTrack, June 1, 2026, https://exatrack.com/publications/apt28-pixynetloader.html (source article; families, infection chain, YARA rules, hunting profile, paths, CLSIDs, hashes)
- “Pawn Storm Targets Government Infrastructure” (PRISMEX), Trend Micro, March 2026, https://www.trendmicro.com/en_gb/research/26/c/pawn-storm-targets-govt-infra.html (alias reconciliation: Pawn Storm, PRISMEX; linked from the source article)
- CERT-UA article 6287250, CERT-UA, February 2026, https://cert.gov.ua/article/6287250 (campaign context; linked from the source article)
- OTX AlienVault file indicator records for 52b6fb40…, c6f13923… and 8c1dc973…, AlienVault, accessed Nov. 2, 2026, https://otx.alienvault.com/ (MD5 and SHA-1 values marked “sourced via OTX”)
- MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/
CVE at a glance
- CVSS
- 7.8 High (v3.1)
- EPSS
- 70.8% chance of exploitation in the next 30 days (higher than 99.3% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Jan 26, 2026
- Public exploit
- Yes, reported in 13 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.