APT28 evolves PixyNetLoader across 4 families

APT28's PixyNetLoader malware evolved across 4 families from 2024-2026, with latest variant using advanced PNG steganography to hide Covenant Grunt payloads.

Between April 2024 and April 2026, APT28 developed and deployed approximately 90 samples of PixyNetLoader malware across four distinct code families (A, B, 58a6e3e4, and C). The loader is delivered via malicious Office documents exploiting CVE-2026-21509, establishes COM persistence, and extracts payloads hidden in companion PNG files using least-significant-bit steganography. Family C, first observed March 2026, introduces a more robust extraction mechanism: the malware embeds a secret key that undergoes SHA-256 hashing and byte permutation, then derives an AES-256 key via PBKDF2-HMAC-SHA256 with 20,000 iterations using a salt extracted from the PNG. The encrypted Covenant Grunt payload is prefixed with a "HIDE" magic header containing offset, size, and checksum metadata. The payloads communicate via the file-sharing service FILEN as a cloud C2 channel.

All four families share common cryptographic routines for string encryption, enabling unified detection through a single YARA rule targeting these shared functions. The malware consistently installs as a 64-bit DLL with COM registry persistence, uses paths like %programdata%\Microsoft\DeviceSync\EdgeSync\start.png for companion files, and exports itself under names mimicking legitimate Windows components (EdgeSyncPr.dll, EhStorShell.dll, stobject.dll). Compilation timestamps correlate closely with deployment dates, suggesting rapid weaponization cycles. The attacker maintains consistent operational security habits including bad PE checksums from post-compilation patching, spoofed Microsoft Corporation version info, and predictable file path patterns that facilitate proactive threat hunting.

Source reporting: https://blog.exatrack.com/Tracking_APT28_PixyNetLoader/