Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics

APT28 (aka Pawn Storm/Fancy Bear) is conducting a spear-phishing campaign active since September 2025 that deploys the PRISMEX malware suite against Ukrainian and allied government, military, and logistics targets; the campaign exploits CVE-2026-21509 and CVE-2026-21513, uses steganography, COM hijacking, and fileless Covenant-based payloads, and blends C2 traffic through Filen.io to support long-term espionage and potential disruptive operations.