Pawn Storm Uses PRISMEX Malware and Exploits Microsoft Office Vulnerability in Campaign Targeting Ukraine and Allies
Summary
Trend Micro details Pawn Storm campaigns targeting Ukrainian and allied government, military, and logistics organizations with PRISMEX malware, steganographic payloads, cloud-based command-and-control, and exploitation of Microsoft vulnerabilities CVE-2026-21509 and CVE
Key points
- Trend Micro attributes the campaigns, active since at least September 2025 and escalating in January 2026, to the Russia-aligned group Pawn Storm, also known as APT28.
- Targets include Ukrainian defense, government, weather and emergency services, as well as allied military, transport, humanitarian and logistics organizations.
- Spear-phishing emails deliver RTF documents that exploit CVE-2026-21509 to retrieve a malicious LNK file from an attacker-controlled WebDAV server.
- The article reports CVE-2026-21513 exploitation before Microsoft's February 10, 2026 patch; its possible use in the same LNK chain is not independently confirmed by Trend Micro.
- PRISMEX comprises droppers, a steganography loader and a Covenant Grunt stager, using image-hidden payloads, COM hijacking, in-memory execution and Filen.io for command-and-control.
- Trend Micro recommends patching both vulnerabilities, restricting unapproved cloud storage, limiting internet-sourced Office macros, and hunting for suspicious COM registrations and unexpected CLR activity.
Article Details
- Attack Vectors
- Spear-phishing emails deliver malicious RTF or Excel attachments using lures related to weather warnings, military training, and weapons alerts.
- Opening a crafted RTF document triggers CVE-2026-21509, causing Office to contact an attacker-controlled WebDAV server and retrieve a malicious LNK file.
- The LNK file may exploit CVE-2026-21513 to bypass security features and execute payloads; TrendAI™ Research says it has not independently confirmed this link in the campaign.
- PrismexSheet uses VBA macros and steganography to extract embedded payloads from an Excel file.
- PRISMEX components use COM hijacking and a scheduled task for persistence, and PrismexLoader extracts payloads hidden in PNG images.
- PrismexStager uses Filen.io for command-and-control communications, payload downloads, and data exfiltration.
- Defensive Notes
- Patch CVE-2026-21509 and CVE-2026-21513 across affected Office and Windows systems.
- Restrict non-business-essential cloud storage services and allow only approved services.
- If patching is not immediately possible, disable the Shell.Explorer.1 COM object through registry settings.
- Block macros in Office files originating from the internet and filter RTF attachments.
- Audit HKCU\Software\Classes\CLSID for user-registered COM objects pointing to %PROGRAMDATA% or %TEMP%.
- Monitor for unexpected CLR initialization in native processes, especially explorer.exe, and enable Microsoft-Windows-DotNETRuntime ETW logging to detect assemblies loaded from byte arrays.
- Enable enhanced Outlook VBA macro logging, monitor unusual email deletion patterns, and audit Outlook VBA projects for unauthorized changes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | wellnesscaremed[.]com | C&C domain used by a CVE-2026-21513 sample and reported as shared campaign infrastructure. |
| SHA256 | aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa | SHA-256 of the CVE-2026-21513 exploit sample identified in the article. |
MITRE ATT&CK
T1027.003 · SteganographyPRISMEX hides payloads in Excel files and PNG images using steganography.T1053.005 · Scheduled TaskPrismexDrop creates a hidden scheduled task that restarts explorer.exe to trigger the hijacked COM object.T1059.005 · Visual BasicPrismexSheet executes VBA macro code when the Excel workbook is opened with macros enabled.T1071.001 · Web ProtocolsPrismexStager communicates with Covenant C&C through web traffic to Filen.io.T1102 · Web ServicePrismexStager abuses Filen.io, a legitimate cloud storage service, for C&C, payload downloads, and data exfiltration.T1204.002 · Malicious FileThe infection chain requires the recipient to open a malicious document to trigger the exploit.T1546.015 · Component Object Model HijackingPRISMEX establishes persistence by registering malicious DLLs as COM object handlers.T1553.005 · Mark-of-the-Web BypassThe article says the LNK stage likely bypasses Mark of the Web, but TrendAI™ Research has not independently confirmed that this campaign's LNK files exploit CVE-2026-21513.T1566.001 · Spearphishing AttachmentPawn Storm delivered malicious RTF or Excel attachments through spear-phishing emails.T1574.002 · DLL Side-LoadingPrismexLoader acts as a proxy DLL, forwarding legitimate exports while executing its payload; the article lists this technique for the campaign.T1620 · Reflective Code LoadingPrismexLoader reconstructs a .NET payload and loads the assembly from a byte array in memory.
CVE
CVE-2026-21509exploits: Pawn Storm’s campaign in late January 2026 exploited the Microsoft Office vulnerability CVE-2026-21509 to target government, military, and critical infrastructure entities across Central and EasternCVE-2026-21513CVE-2026-21513: The LNK exploit sample appeared on VirusTotal on January 30, 2026, while Microsoft's patch was not released until February 10, 2026. This 11-day gap confirms zero-day exploitation in the wild.
Threat Actors
APT28The article explicitly identifies APT28 as another name for Pawn Storm.Fancy BearThe article explicitly identifies Fancy Bear as another name for Pawn Storm.Forest BlizzardThe article explicitly identifies Forest Blizzard as another name for Pawn Storm.Pawn StormThe article attributes the PRISMEX campaigns to Pawn Storm with high confidence.UAC-0001The article explicitly identifies UAC-0001 as another name for Pawn Storm.
Malware
MiniDoorThe C&C server delivers one of two primary payload chains: Path A (PRISMEX) or Path B (MiniDoor Chainm which is reported by Zscaler ThreatLabz). NotDoorassesses that the campaigns that use PrismexStager likely represent a strategic expansion of the "NotDoor" ecosystem, extending its multiple infection chains to now include rapid exploitation of newly disclosedPRISMEXcyber espionage group Pawn Storm has deployed a new malware suite that TrendAI™ Research identifies as PRISMEX. The APT group also known as APT28, Fancy Bear, UAC-0001 and Forest Blizzard in its latest observedPrismexDropcharacteristic of distributing the payload across the entire image. It is comprised of a dropper (PrismexDrop), a steganography loader (PrismexLoader), and a Covenant Grunt implant (PrismexStager). PrismexLoaderpayload across the entire image. It is comprised of a dropper (PrismexDrop), a steganography loader (PrismexLoader), and a Covenant Grunt implant (PrismexStager). PrismexSheetPrismexSheet: A malicious Excel dropper with VBA macros that extracts payloads embedded within the file itself using steganography techniques. PrismexStagerof a dropper (PrismexDrop), a steganography loader (PrismexLoader), and a Covenant Grunt implant (PrismexStager).
Vendors
Products
Microsoft Officeand rapidly weaponizing N-day exploits: Pawn Storm’s campaign in late January 2026 exploited the Microsoft Office vulnerability CVE-2026-21509 to target government, military, and critical infrastructure entitiesMicrosoft WindowsTarget CLSID: This CLSID relates to UnexpectedShutdownReason, which is referenced by mechanisms handling Windows shutdown reasons and power management information. MSHTMLleverages malicious .LNK files, the vulnerable code path can be triggered through any component embedding MSHTML. Therefore, additional delivery mechanisms beyond LNK-based phishing should be expected.
Tools
Covenantentire image. It is comprised of a dropper (PrismexDrop), a steganography loader (PrismexLoader), and a Covenant Grunt implant (PrismexStager). rtfobjFigure 2. Dumped object information from a CVE-2026-21509 exploit sample using rtfobj, showing the Shell.Explorer.1 CLSID By embedding a specifically crafted OLE object referencing this CLSID within a Rich Text FormatVirusTotalCVE-2026-21513: The LNK exploit sample appeared on VirusTotal on January 30, 2026, while Microsoft's patch was not released until February 10, 2026. This 11-day gap confirms zero-day exploitation in the wild.
Countries
Czech RepublicSlovakia and Czech Republic: Political and logistical support partners involved in ammunition initiatives. PolandPoland: Rail logistics. Poland serves as the primary transit hub for Western military aid entering Ukraine. RomaniaRomania, Slovenia, Turkey: Maritime and transport sectors. Romania is critical for Black Sea grain corridors and alternative supply routes. RussiaThis operation demonstrates that Pawn Storm remains one of the most aggressive Russia-aligned intrusion sets. It also emphasizes the group’s notoriety in leveraging newly disclosed vulnerabilities and rapidlySlovakiaSlovakia and Czech Republic: Political and logistical support partners involved in ammunition initiatives. SloveniaRomania, Slovenia, Turkey: Maritime and transport sectors. Romania is critical for Black Sea grain corridors and alternative supply routes. TurkeyRomania, Slovenia, Turkey: Maritime and transport sectors. Romania is critical for Black Sea grain corridors and alternative supply routes. Ukraineescalated in January 2026, and continue the long-lasting brazen attacks that Pawn Storm deploys against Ukraine since 2014.
Industries
Defenseand Forest Blizzard in its latest observed campaigns target the operational backbone of Ukrainian defense and Western humanitarian and military aid infrastructure. The campaigns, which have been active since atEmergency ServicesSectors: Central Executive Bodies, Hydrometeorology (Strategic planning for ground/drone operations), Defense, Emergency Services. Governmentcampaign in late January 2026 exploited the Microsoft Office vulnerability CVE-2026-21509 to target government, military, and critical infrastructure entities across Central and Eastern Europe. The campaign’sHumanitarian AidHydrometeorologySectors: Central Executive Bodies, Hydrometeorology (Strategic planning for ground/drone operations), Defense, Emergency Services. Transportation