Loading malware…
PixyNetLoader is a Windows DLL-based malware loader associated with APT28/Fancy Bear espionage operations. It has been observed in campaigns targeting government, military, public-sector, maritime, transport, and other organizations in Central and Eastern Europe, particularly Ukraine, Slovakia, and Romania. The malware is used as part of multi-stage intrusion chains to establish persistence, prepare the host environment, and deploy a Covenant Grunt implant that provides command-and-control capability to the operators.
PixyNetLoader has been delivered through weaponized Microsoft Office documents exploiting CVE-2026-21509, including malicious RTF, Word, and XLS-based lures. After exploitation, an earlier-stage dropper installs PixyNetLoader and associated components. The loader is notable for combining COM hijacking persistence, scheduled-task-assisted execution, DLL proxying/sideloading behavior, and steganographic payload concealment. In documented chains, PixyNetLoader drops a malicious DLL that is loaded by Explorer through hijacked COM registration, along with a companion PNG image containing hidden shellcode or an encrypted Covenant payload.
A defining characteristic of PixyNetLoader is its use of PNG steganography. Variants extract payload data from the least significant bits of image pixels and execute the recovered code directly in memory. Newer variants introduced a more advanced extraction and decryption workflow using embedded secrets, SHA-256, PBKDF2-HMAC-SHA256, and AES-CBC before in-memory execution. The final payload across reported variants is a Covenant Grunt implant, and associated operations have used the FILEN cloud service as a command-and-control channel to blend malicious traffic with legitimate cloud usage.
The malware family has evolved across multiple code families from 2024 through 2026, with shared traits including string encryption, PE parsing, import resolution, in-memory execution, and stable persistence patterns. Some variants include anti-analysis checks such as timing-based sandbox detection and execution gating tied to specific host processes. PixyNetLoader is best characterized as a stealth-focused loader used to stage post-exploitation tooling for Russian state-aligned cyber-espionage activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
2026-02-04 ⋅ StrikeReady ⋅ APT28’s Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and Cloud C2 Infrastructure ... 2026-02-02 ⋅ Zscaler ⋅ APT28 Leverages CVE-2026-21509 in Operation Neusploit | 2026-06-01 ⋅ ExaTrack ⋅ Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2026-06-01 ⋅ ExaTrack ⋅ Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent entries include “Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days”, “Operation RoundPress”, and “Leveraging CVE‑2026‑21509”.
Executes the following command using the CreateProcess Windows API to set up a Windows scheduled task... schtasks.exe /Create /tn "OneDriveHealth" /XML "%temp%\Diagnostics\office.xml"
Cieľom je nainštalovať malvér MiniDoor (kradne e-maily) a PixyNetLoader, ktorý nainštaluje útočný nástroj Covenant.
“%windir%\system32\cmd.exe /c (taskkill … explorer.exe) & (start explorer …) & (schtasks /delete …)”
This threat fits a relatively standard compromise scheme through vulnerability exploitation via a malicious .DOC file ( CVE-2026-21509 in February 2026) executing a version of the SimpleDropper code
Uses COM object hijacking to establish persistence. EhStorShell.dll is the legitimate name for the Enhanced Storage Shell Extension DLL. By setting the Windows registry keys listed in the table below, PixyNetLoader ensures that the next-stage malicious shellcode loader DLL is loaded each time the explorer.exe process starts.
Executes the following command using the CreateProcess Windows API to set up a Windows scheduled task... schtasks.exe /Create /tn "OneDriveHealth" /XML "%temp%\Diagnostics\office.xml"
APT28 evolved PixyNetLoader, utilizing COM persistence, PNG steganography, and FILEN-based cloud C2
All the embedded payloads are decrypted and dropped to the file system locations in the table below: %programdata%\Microsoft OneDrive\setup\Cache\SplashScreen.png ... %temp%\Diagnostics\office.xml
The embedded and hashed secret is then transformed into an AES key via a PBKDF2 HMAC SHA256 of 20000 iterations using the extracted SALT The header is decrypted
CVE-2026-21509 možno zneužiť podvrhnutím špeciálne vytvorených súborov na obídenie bezpečnostných mechanizmov pre ochranu pred zneužitím niektorých funkcií COM/OLE a získanie úplnej kontroly nad systémom.
“Creates a mutex with the static name adjgfenkbe.” / “Creates a mutex with the name asagdugughi41.” / “Creates a mutex named dvyubgbqfusdv32.”
the loader only activates its malicious logic if the infected machine is not an analysis environment and when the host process that launched the DLL is "explorer.exe." The malware stays dormant if the conditions are not met.
Uses COM object hijacking to establish persistence. EhStorShell.dll is the legitimate name for the Enhanced Storage Shell Extension DLL. By setting the Windows registry keys listed in the table below, PixyNetLoader ensures that the next-stage malicious shellcode loader DLL is loaded each time the explorer.exe process starts.
The Grunt payload uses the FILEN cloud service as its command-and-control channel.
CERT-UA said. "During the investigation, it was found that opening the document using Microsoft Office leads to establishing a network connection to an external resource using the WebDAV protocol..."
123 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used by APT28, tracked over multiple years.
Loader used by APT28 featuring COM persistence, PNG steganography, and cloud-based C2 via FILEN.
A DLL-based malware loader that uses steganography to hide encrypted payloads inside PNG image files, installs persistence via COM, extracts a Covenant Grunt payload from image pixel LSBs, and executes it in memory while using the FILEN cloud service for command-and-control.
A malware loader attributed to APT28 that exploits a Microsoft Office vulnerability to deliver a COVENANT Grunt implant.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.