Fancy Bear Uses LSB Steganography and Reflective Loading to Run C# Remote

Gbhackers •Mayura Kathir • July 8, 2026

A new intrusion campaign attributed to APT‑C‑20 (aka Fancy Bear, APT28) demonstrates the group’s continued refinement of stealthy, fileless techniques: weaponized Office documents that deploy a COM‑hijacking DLL. Extract shellcode hidden via LSB steganography in a PNG, and use reflective loading to run an obfuscated C# remote‑control Trojan that communicates through the legitimate cloud storage […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT-C-20 Uses Steganography to Deploy Fileless C# Backdoor APT-C-20, also known as Fancy Bear or APT28, has launched a new intrusion campaign utilizing advanced techniques to evade detection. The group employs LSB steganography to hide shellcode within PNG images, allowing them to execute a fileless C# remote-control Trojan. This method leverages weaponized Office documents that deploy a COM-hijacking DLL to facilitate the attack. The backdoor communicates through legitimate cloud storage services, enhancing its stealth. The campaign reflects the group's ongoing evolution in cyber tactics, focusing on stealth and evasion. Organizations using vulnerable Office applications and cloud storage services are at risk. The full scope of the impact is still being assessed as the campaign is ongoing. 2 sources 76

Extracted Entities

Fancy Bear Uses LSB Steganography and Reflective Loading to Run C# Remote

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

MITRE ATT&CK (3)