This blog discusses the steganography, cloud abuse, and email-based backdoors used against the Ukrainian defense supply chain in the latest Pawn Storm campaign that TrendAI™ Research observed and analyzed.

Trend Micro Blog offers insights, analysis, and updates on cybersecurity threats, trends, and best practices. Covering topics such as malware analysis, threat intelligence, and cybersecurity risk management, Trend Micro Blog provides resources for IT security professionals, helping them stay ahead of emerging threats and protect their organizations from cyber attacks.

Trend Micro

Trend Micro's TrendAI Research details a new malware suite called PRISMEX deployed by Russia-aligned APT group Pawn Storm (APT28/Fancy Bear) targeting Ukrainian defense supply chains and NATO allies including Poland, Romania, Slovakia, Czech Republic, Slovenia, and Turkey. PRISMEX consists of four interconnected components: PrismexSheet (Excel dropper with VBA macros), PrismexDrop (native dropper using COM hijacking), PrismexLoader (proxy DLL using a unique 'Bit Plane Round Robin' steganography algorithm), and PrismexStager (Covenant Grunt implant abusing Filen.io cloud storage for C2). The campaign exploited CVE-2026-21509 (Microsoft Office OLE security bypass) and a confirmed zero-day CVE-2026-21513 (MSHTML framework), with infrastructure preparation beginning two weeks before public disclosure. Beyond espionage, wiper commands were observed, indicating potential sabotage capability. Mitigations include patching both CVEs, restricting cloud storage access, disabling the Shell.Explorer.1 COM object, and monitoring for unusual CLR initialization in native processes.

Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities