HighCVE-2026-21509 4 Hunt LeadsYARAIOCsHands-On-KeyboardAPT28PixyNetLoaderSimpleDropperCovenant GruntExaTrack
APT28 Hides Its Implants in PNGs and Rebuilds the Loader Every Few Weeks
ExaTrack tracked about 90 samples of PixyNetLoader, an APT28 loader that pulls a Covenant implant out of PNG pixels and talks to its operators through the Filen cloud service.