APT-C-20 Hackers Hide Shellcode in PNG Images to Launch Fileless C# Backdoor

Cybersecuritynews •Tushar Subhra Dutta • July 8, 2026

A well known hacking group has found a clever way to sneak malicious code past security tools, using an ordinary picture file. The group, tracked as APT-C-20 and known as APT28 or Fancy Bear, hides shellcode inside PNG images to launch a fileless backdoor written in C#. This lets attackers avoid dropping malware files on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT-C-20 Uses Steganography to Deploy Fileless C# Backdoor APT-C-20, also known as Fancy Bear or APT28, has launched a new intrusion campaign utilizing advanced techniques to evade detection. The group employs LSB steganography to hide shellcode within PNG images, allowing them to execute a fileless C# remote-control Trojan. This method leverages weaponized Office documents that deploy a COM-hijacking DLL to facilitate the attack. The backdoor communicates through legitimate cloud storage services, enhancing its stealth. The campaign reflects the group's ongoing evolution in cyber tactics, focusing on stealth and evasion. Organizations using vulnerable Office applications and cloud storage services are at risk. The full scope of the impact is still being assessed as the campaign is ongoing. 2 sources 76

APT-C-20 Hackers Hide Shellcode in PNG Images to Launch Fileless C# Backdoor

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)