APT28 evolves PixyNetLoader across 4 families
APT28's PixyNetLoader malware evolved across 4 families from 2024-2026, with latest variant using advanced PNG steganography to hide Covenant Grunt payloads.
Sourceblog.exatrack.com — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-21509 as exploited in the wild.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Between April 2024 and April 2026, APT28 developed and deployed approximately 90 samples of PixyNetLoader malware across four distinct code families (A, B, 58a6e3e4, and C). The loader is delivered via malicious Office documents exploiting CVE-2026-21509, establishes COM persistence, and extracts payloads hidden in companion PNG files using least-significant-bit steganography. Family C, first observed March 2026, introduces a more robust extraction mechanism: the malware embeds a secret key that undergoes SHA-256 hashing and byte permutation, then derives an AES-256 key via PBKDF2-HMAC-SHA256 with 20,000 iterations using a salt extracted from the PNG. The encrypted Covenant Grunt payload is prefixed with a "HIDE" magic header containing offset, size, and checksum metadata. The payloads communicate via the file-sharing service FILEN as a cloud C2 channel.
All four families share common cryptographic routines for string encryption, enabling unified detection through a single YARA rule targeting these shared functions. The malware consistently installs as a 64-bit DLL with COM registry persistence, uses paths like %programdata%\Microsoft\DeviceSync\EdgeSync\start.png for companion files, and exports itself under names mimicking legitimate Windows components (EdgeSyncPr.dll, EhStorShell.dll, stobject.dll). Compilation timestamps correlate closely with deployment dates, suggesting rapid weaponization cycles. The attacker maintains consistent operational security habits including bad PE checksums from post-compilation patching, spoofed Microsoft Corporation version info, and predictable file path patterns that facilitate proactive threat hunting.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://blog.exatrack.com/Tracking_APT28_PixyNetLoader/
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs