Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

This blog discusses the steganography, cloud abuse, and email-based backdoors used against the Ukrainian defense supply chain in the latest Pawn Storm campaign that TrendAI™ Research observed and analyzed.

By: Feike Hacquebord, Kakara Hiroyuki Mar 26, 2026 Read time: ( words)

Prolific Russian-aligned cyber espionage group Pawn Storm has deployed a new malware suite that TrendAI™ Research identifies as PRISMEX. The APT group also known as APT28, Fancy Bear, UAC-0001 and Forest Blizzard in its latest observed campaigns target the operational backbone of Ukrainian defense and Western humanitarian and military aid infrastructure. The campaigns, which have been active since at least September 2025, significantly escalated in January 2026, and continue the long-lasting brazen attacks that Pawn Storm deploys against Ukraine since 2014.

This operation demonstrates that Pawn Storm remains one of the most aggressive Russia-aligned intrusion sets. It also emphasizes the group’s notoriety in leveraging newly disclosed vulnerabilities and rapidly weaponizing N-day exploits: Pawn Storm’s campaign in late January 2026 exploited the Microsoft Office vulnerability CVE-2026-21509 to target government, military, and critical infrastructure entities across Central and Eastern Europe. The campaign’s infrastructure preparation was observed to have begun two weeks prior, hinting of the group’s advanced knowledge of the vulnerability.

Looking into these latest Pawn Storm campaigns, TrendAI™ Research identified a series of interconnected malware components collectively referred to as "PRISMEX,” named for its steganographic characteristic of distributing the payload across the entire image. It is comprised of a dropper (PrismexDrop), a steganography loader (PrismexLoader), and a Covenant Grunt implant (PrismexStager).

Covenant is an open-source . NET command and control (C&C) framework, and Grunts are its implant agents that feature dynamic compilation and encrypted command-and-control communications. These components are designed to evade modern Endpoint Detection and Response (EDR) systems through "fileless" execution, advanced steganography, and abuse of legitimate cloud services. TrendAI™ Research assesses that the campaigns that use PrismexStager likely represent a strategic expansion of the "NotDoor" ecosystem, extending its multiple infection chains to now include rapid exploitation of newly disclosed vulnerabilities. TrendAI™ Research also investigated the NotDoor ecosystem in early 2025 and continues to monitor its evolution.

The use of the Covenant framework for final payloads has previously been documented by CERT-UA and Sekoia.io since mid-2025, but this current wave of attacks is distinguished by the rapid integration of CVE-2026-21509.

Analysis confirms technical links between the PRISMEX components and Pawn Storm activities that TrendAI™ Research has been tracking. Strategically, this latest operation focuses heavily on targeting the Ukrainian defense supply chain. This includes military allies, meteorological data providers, transport hubs, and international aid corridors that are essential to Ukrainian defense and humanitarian operations.

This campaign has also been reported by CERT-UA , Zscaler ThreatLabz , and Synaptic Systems , with each organization providing complementary perspectives on the threat.

TrendAI™ Research has tracked Pawn Storm's activities across three distinct but interconnected campaigns, each building upon its infrastructure and tooling. This evolution demonstrates the threat actor's continuous adaptation and capability development.

Infrastructure preparation timeline

The timeline of this campaign indicates advanced knowledge of multiple vulnerabilities:

This pattern suggests Pawn Storm had access to vulnerability details ahead of public disclosure.

The PRISMEX campaign’s initial access vector relies on the weaponization of CVE-2026-21509, a security feature bypass vulnerability in the Microsoft Office Object Linking and Embedding (OLE) mechanism. Unlike typical memory corruption exploits, this vulnerability exploits a logical gap in the Microsoft Office OLE allowlist mechanism;Specifically, Office failed to strictly block the instantiation of the Shell.Explorer.1 COM object (CLSID: EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B).

CVE-2026-21509 technical details:

CVE-2026-21513 resides in the logic responsible for handling hyperlink within ieframe.dll (Internet Explorer frame). Insufficient validation of the target URL allows attacker-controlled input to reach code paths that invoke ShellExecuteExW , enabling execution of local or remote resources outside the intended browser security context.

The LNK file embeds an HTML payload immediately after the standard LNK structure. This payload leverages nested iframes and multiple DOM contexts to manipulate trust boundaries. The exploit creates an htmlfile ActiveX object to expose the DOM interface, then uses nested :blank iframes to establish multiple execution contexts with manipulable trust relationships. The core exploit invokes document.Script.open() with a _parent target parameter, reaching the vulnerable _ AttemptShellExecuteForHlinkNavigat function and achieving code execution outside the browser sandbox.

CVE-2026-21513 was exploited as a zero-day vulnerability. The exploit sample (SHA256: aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa ) was first submitted to VirusTotal on January 30, 2026. This was 11 days before Microsoft released the patch on February 10, 2026. Akamai researchers correlated this sample with the vulnerable code path and attributed it to APT28 infrastructure.

While the observed campaign leverages malicious . LNK files, the vulnerable code path can be triggered through any component embedding MSHTML. Therefore, additional delivery mechanisms beyond LNK-based phishing should be expected.

The possible two-stage exploitation

Akamai researchers reported an in-the-wild exploit sample for CVE-2026-21513 , a critical security feature bypass vulnerability within Microsoft's MSHTML framework. This sample communicates with the same C&C domain ( wellnesscaremed[.]com ) used in the campaign exploiting CVE-2026-21509, suggesting a potential connection between the two exploits.

If the . lnk files retrieved via the CVE-2026-21509 exploit chain leverage CVE-2026-21513, this would represent a sophisticated two-stage exploitation: the first vulnerability (CVE-2026-21509) forces the victim's system to retrieve a malicious . lnk file, which then exploits the second vulnerability (CVE-2026-21513) to bypass security features and execute payloads without user warnings. While TrendAI™ Research has yet to independently confirm this linkage, the shared infrastructure and timing strongly suggest these exploits are part of the same campaign.

LNK execution (potential CVE-2026-21513 exploitation)

TrendAI™ Research uses the name "PRISMEX" to collectively refer to the interconnected malware components identified across these campaigns. While our investigation cannot confirm whether the threat actor developed these as a unified framework, TrendAI™ Research has observed that the components work together in coherent infection chains designed to evade modern EDR systems through fileless execution, advanced steganography, and abuse of legitimate cloud services.

PRISMEX includes the following components, which this section analyzes in detail:

PrismexSheet: The Excel dropper

PrismexSheet is a highly obfuscated Excel dropper that serves as the initial access vector in the September-December 2025 steganography campaign. The specimen is designed to extract malicious payloads (executable files and configuration information) hidden within the Excel file's binary data area and execute/persist them on the infected terminal. A notable feature is the use of steganography techniques to embed the payload within the file itself.

TrendAI™ Research identified and analyzed several variants of PrismexSheet, all sharing the same core functionality but with variations in configuration and obfuscation. The malware execution flow consists of five distinct stages illustrated in figure 4.

Stage 1: Initialization and evasion

When the macro is enabled, Workbook_Open is triggered to perform initial setup and sandbox evasion:

Stage 2: Configuration and payload extraction

The macro reads the Excel file's own binary data and searches for specific signatures to locate embedded components:

Stage 3: File dropping

Based on the extracted configuration, the macro generates the following files:

Stage 4: Persistence via COM hijacking

PrismexSheet establishes persistence by hijacking a COM object that is loaded by explorer.exe:

Stage 5: Execution and reconnaissance

In most variants, the macro performs additional reconnaissance before completing:

The Excel files display convincing decoy content after macros are enabled. The decoy themes observed include:

These decoy themes strongly suggest the intention to target Ukrainian military drone operation units and their logistics departments. The specific geographic distribution of VirusTotal uploads (Vasylkivka, Mykolaiv, Kyiv, Kharkiv) indicates targeting of both frontline units and central command structures.

PrismexDrop: The dropper

PrismexDrop is a dropper designed to prepare the environment for subsequent stages. It does not contain network capabilities itself but is responsible for placing artifacts on disk and establishing persistence.

PrismexLoader: The Proxy DLL

This component masquerades as the legitimate Windows DLL like EhStorShell.dll . It functions as a Proxy DLL, forwarding legitimate function exports to the real system DLL to prevent crashing the host process, while silently executing its malicious payload in a background thread.

The "Bit Plane Round Robin" steganography algorithm

The most distinctive feature of PrismexLoader is its unique method of extracting the stage from SplashScreen.png . Unlike common Least Significant Bit (LSB) techniques which hide data in the last bit of consecutive bytes (often filling the image from top to bottom), this malware uses a custom "Bit Plane Round Robin" distribution that scatters the payload across the entire file structure in multiple passes.

The algorithm works as follows:

This specific algorithmic implementation is identical to code used in a Pawn Storm campaign from 2025 that targeted Ukrainian military drone lists. This exact algorithm has not been observed in public repositories, serving as a high-fidelity fingerprint for this developer unit.

Payload extraction and in-memory execution via CLR bootstrapping

After reconstructing the raw byte stream from the steganographic image, PrismexLoader performs several critical steps to prepare and execute the .NET payload entirely in memory:

This approach provides several advantages from an evasion perspective: the . NET payload never touches the filesystem (evading file-based detection), the malicious code executes within explorer.exe (a highly trusted system process), and the payload exists only in memory until the host process terminates (leaving minimal forensic evidence).

PrismexStager: Covenant Grunt stager

The payload extracted from the image is the Covenant Grunt Stager, which we have internally tracked as PrismexStager. This is a .NET assembly responsible for C&C and executing further tasks from the Covenant framework. It is heavily obfuscated with randomized function names to hinder static analysis.

The malware abuses the legitimate end-to-end encrypted cloud storage service Filen.io for C&C communications. By leveraging this trusted service, the malicious traffic blends in with normal encrypted web traffic, effectively bypassing reputation-based filtering and firewall rules.

The C&C infrastructure utilizes multiple Filen.io subdomains:

Table 1. A summary of MITRE ATT&CK techniques used in the observed Pawn Storm ccampaigndiscussed in this blog

The targeting pattern reveals a strategic intent to compromise the supply chain and operational planning capabilities of Ukraine and its NATO partners. This targeting is a continuation of campaigns where Pawn Storm used their foothold in related organizations like border police, military, parliament and a meteorological institute. The choice of these sender organizations appears strategic: recipients in target organizations would be more likely to open attachments from such trusted sources, particularly those involved in cross-border cooperation and military training programs.

Targets in NATO Logistics Hubs and military allies of Ukraine:

Based on technical artifacts, infrastructure overlaps, and victimology, TrendAI™ Research attributes this campaign to Pawn Storm with high confidence. This assessment is significantly bolstered by threat hunting data and internal telemetry that correlates the PRISMEX components with specific operations monitored by TrendAI™.

This attribution applies the threat attribution framework of TrendAI™, which uses an adapted version of the Diamond Model to anchor observations across four interdependent nodes (adversary, capability, infrastructure, and victim), an evidence-based scoring system to measure the strength of each piece of information, and Analysis of Competing Hypotheses (ACH) to test conclusions against alternative explanations.

For details on our methodology, see Threat Attribution Framework: How TrendAI™ Applies Structure Over Speculation .

Custom tooling requires development effort and often persists across campaigns, making it a strong indicator of actor capability:

Infrastructure choices that persist over time carry more weight than disposable indicators:

Certain behaviors and operational patterns recur across campaigns:

Repeated victim selection reflects strategic intent:

Confidence assessment

Evidence aligns across all four Diamond Model nodes. Alternative hypotheses, including false flag operations and tool sharing scenarios, were tested through ACH and found inconsistent with the totality of evidence. The unique steganography algorithm and MiniDoor/NotDoor malware lineage serve as primary attribution anchors, as these are not tools available on underground markets or shared between groups. This convergence of evidence across capability, infrastructure, adversary behavior, and victimology supports our high-confidence attribution to Pawn Storm.

The timing and targeting of these campaigns reflect a shift in Russian military intelligence priorities toward operational and tactical disruption of Ukrainian logistics, rather than purely strategic political intelligence.

In the context of 2026

As the geopolitical conflict between involved territories enters its fifth year, the static nature of front lines has elevated the importance of ancillary support systems:

Potential for destructive operations

The deployment of the post-exploitation framework Covenant Grunt indicates intent to move laterally within compromised networks. Access to a rail logistics network or a national weather service could be used not just for data theft, but as a beachhead for destructive attacks (which could include but is not limited to wiping servers or falsifying data) timed to coincide with kinetic military operations.

TrendAI™ Research analysis of the October 2025 campaign observed not only information-gathering tasks but also a destructive wiper command that deleted all files under %USERPROFILE%. This dual capability confirms that these campaigns may serve both espionage and sabotage objectives.

The PRISMEX components represent a capable and stealthy addition to Pawn Storm's arsenal. By combining zero-day exploitation (CVE-2026-21513) with rapid weaponization of newly disclosed vulnerabilities (CVE-2026-21509), valid cloud infrastructure, and unique steganography, the actor has demonstrated a continued ability to evolve. The strategic focus on targeting the supply chains, weather services, and humanitarian corridors supporting Ukraine represents a shift toward operational disruption that may presage more destructive activities.

The technical links between the PRISMEX components and campaigns demonstrate the threat actor's continuous development cycle and modular approach to capability building. Organizations in the targeted geographic and industry sectors should consider themselves at elevated risk and implement the countermeasures detailed above immediately.

The use of newly disclosed vulnerabilities and legitimate cloud services makes detection challenging. Defenders must adopt an "assume breach" mentality and focus on behavioral anomalies rather than just static indicators.

Immediate mitigations

Detection and hunting

TrendAI Vision One™ is the industry-leading AI cybersecurity platform that centralizes cyber risk exposure management, security operations, and robust layered protection.TrendAI Vision One™ Threat Intelligence Hub

TrendAI Vision One™ Threat Intelligence Hub provides the latest insights on emerging threats and threat actors, exclusive strategic reports from TrendAI™ Research, and TrendAI Vision One™ Threat Intelligence Feed in the TrendAI Vision One™ platform.

TrendAI Vision One™ Intelligence Reports (IOC Sweeping)

Intelligence Reports for Pawn Storm can be accessed here .

TrendAI Vision One™ App

Hunting queries are available for TrendAI Vision One™ with Threat Intelligence Hub entitlement enabled.

The IoC list can be found in this link .