Technadu APT28's Operation MacroMaze: Macro Malware Campaign Targets Europe
Article Content
Browse articles 
APT28, a Russia-linked advanced persistent threat group, conducted a cyberespionage campaign named Operation MacroMaze from September 2025 to January 2026. The campaign involved deploying macro malware embedded in Microsoft Office documents and utilized webhook-based methods for command-and-control communications and data exfiltration, affecting various entities across Western and Central Europe.
Ask AI about this cluster
Answers cite the sources they use
Updated 218d ago How this analysis works
Timeline
2025-09-01
Operation MacroMaze campaign began
2026-01-31
Operation MacroMaze campaign ended
2026-02-24
Articles published detailing the campaign
More articles in this cluster (3)
Following this threat?
Track APT28 and CVE-2026-21509 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that… 
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…