Fancy Bear Uses LSB Steganography and Reflective Loading to Run C# Remote-Control Trojan

A newly observed intrusion campaign attributed to APT‑C‑20 (Fancy Bear) uses a malicious Office macro dropper that writes dnxstore.dll and EdgeLogo.png, registers a hijacked CLSID to force explorer.exe to load the attacker DLL (COM hijacking), extracts shellcode from a PNG via LSB steganography, and reflectively loads an obfuscated C# remote‑control Trojan (Publish.exe) that communicates through Filen.io gateways; the report describes anti‑analysis checks, in‑memory execution, and defensive mitigations including macro hardening, COM registry monitoring, and network allowlisting.