ThreatCluster

APT-C-20 Uses Steganography to Deploy Fileless C# Backdoor

First seen 9 Jul 2026, 00:48 UTC • •76

Article Content

1 / 3

Browse articles

ThreatCluster •July 10, 2026 at 00:24 UTC

•APT-C-20 uses LSB steganography to hide malicious code in PNG images.
•The attack employs a fileless C# backdoor that avoids traditional malware detection.
•Organizations using vulnerable Office documents and cloud services are at risk.

APT-C-20, also known as Fancy Bear or APT28, has launched a new intrusion campaign utilizing advanced techniques to evade detection. The group employs LSB steganography to hide shellcode within PNG images, allowing them to execute a fileless C# remote-control Trojan. This method leverages weaponized Office documents that deploy a COM-hijacking DLL to facilitate the attack. The backdoor communicates through legitimate cloud storage services, enhancing its stealth. The campaign reflects the group's ongoing evolution in cyber tactics, focusing on stealth and evasion. Organizations using vulnerable Office applications and cloud storage services are at risk. The full scope of the impact is still being assessed as the campaign is ongoing.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 92d ago How this analysis works

Timeline

2026-07-08

APT-C-20 campaign reported

APT-C-20's new intrusion campaign was detailed, highlighting their use of steganography and fileless techniques.

2026-07-08

Shellcode hidden in PNG images

The group was reported to be hiding shellcode in PNG images to launch a C# backdoor, evading security measures.

Cybersecuritynews

More articles in this cluster (2)

Threat Graph

8 entities, 15 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

APT28
Apt-c-20
Fancy Bear

Technique (5)

Malware
Trojan
T1055 - Process Injection
T1071 - Application Layer Protocol
T1574.001 - DLL

Relationships

APT28 uses Malware
APT28 uses Trojan
APT28 uses T1055 - Process Injection
APT28 uses T1071 - Application Layer Protocol
APT28 uses T1574.001 - DLL
Apt-c-20 uses Malware
Apt-c-20 uses Trojan
Apt-c-20 uses T1055 - Process Injection
Apt-c-20 uses T1071 - Application Layer Protocol
Apt-c-20 uses T1574.001 - DLL
Fancy Bear uses Malware
Fancy Bear uses Trojan
Fancy Bear uses T1055 - Process Injection
Fancy Bear uses T1071 - Application Layer Protocol
Fancy Bear uses T1574.001 - DLL

Following this threat?

Track APT28 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

2026 AV-Comparatives EPR Test Results Released AV-Comparatives published the results of its 2026 Endpoint Prevention and Response (EPR) Test, evaluating 14 enterprise security products against 50 multi-stage attack scenarios. The test, which ran from May to August 2026, incorporated AI-assisted techniques and followed the MITRE ATT&CK framework. Eleven products…

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…