Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

TrendAI Research attributes a high-confidence Pawn Storm (APT28) campaign — active since at least September 2025 and escalating in January 2026 — that deploys a modular malware suite named PRISMEX to target Ukrainian defense supply chains and NATO logistics. The campaign weaponizes two security feature bypass flaws (CVE-2026-21509 in Office OLE and CVE-2026-21513 in MSHTML), uses advanced steganography (a Bit Plane Round Robin algorithm) and fileless .NET execution via Covenant Grunt stagers, abuses legitimate cloud storage (Filen.io) for C2, and demonstrates capabilities for both espionage and destructive actions; the report includes IoC references, MITRE ATT&CK mappings, and immediate mitigations (patching, macro restrictions, registry audits, and network controls).