APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies

APT28 (aka Pawn Storm) has run a spear-phishing campaign since at least September 2025 to deliver a modular malware family dubbed PRISMEX against Ukrainian and allied targets; the campaign weaponizes zero-day vulnerabilities (CVE-2026-21509, CVE-2026-21513), leverages steganography, COM hijacking, and legitimate cloud services for C2, and deploys components (PrismexSheet, PrismexDrop, PrismexLoader, PrismexStager) that enable credential/exfiltration operations and, in some cases, destructive wiper actions—indicating a blend of espionage and sabotage objectives.