Executive summary

Trend Micro reported on 26 March 2026 that Pawn Storm, which it describes as a Russia-aligned advanced persistent threat (APT) group, has been using PRISMEX, a collection of interconnected malware components, to target the defence supply chain of Ukraine and its allies, including the Czech Republic, Poland, Romania, Slovakia, Slovenia and Turkey. Trend says the campaigns have been active since at least September 2025, significantly escalated in January 2026 and, in late January, exploited CVE-2026-21509, a Microsoft Office flaw that Microsoft disclosed and the US Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities (KEV) catalogue on 26 January 2026. Trend also calls the Windows MSHTML flaw CVE-2026-21513 a confirmed zero-day that Pawn Storm exploited, but the sample behind that, first submitted to VirusTotal on 30 January, is one Akamai tied to APT28 infrastructure, and Trend says it has not independently confirmed that the shortcut (.lnk) files in this campaign exploit CVE-2026-21513. Trend attributes the campaign to Pawn Storm with high confidence and says it observed both espionage and potential sabotage functionality, including, in an October 2025 campaign, a wiper command. We assess it is likely (B2) that Pawn Storm will keep targeting the Ukrainian and allied sectors Trend lists with lures built on newly disclosed Office and Windows flaws, because Trend documents activity since at least September 2025 and describes the group's notoriety in leveraging newly disclosed vulnerabilities.

Contextual background

Trend Micro's researchers, writing as TrendAI Research, call Pawn Storm a prolific Russia-aligned cyber espionage group and list it as also known as APT28, Fancy Bear, UAC-0001 and Forest Blizzard; the equivalences are Trend's. Trend says the new campaigns continue attacks Pawn Storm has run against Ukraine since 2014, and that it has tracked three distinct but interconnected campaigns, each building on its predecessor's infrastructure and tooling. It describes the late-January 2026 wave as targeting government, military and critical infrastructure entities across Central and Eastern Europe, and the operation as focused heavily on the Ukrainian defence supply chain: military allies, meteorological data providers, transport hubs and international aid corridors.

Trend's victimology lists the targets below. It names no victim organisation, and neither do we.

Country Sectors, as Trend lists them
Ukraine Central executive bodies, hydrometeorology, defence and emergency services
Poland Rail logistics
Romania, Slovenia and Turkey Maritime and transport sectors
Slovakia and the Czech Republic Political and logistical support partners involved in ammunition initiatives

Trend says the actor used compromised accounts from law enforcement, parliamentary and military education institutions in Romania and Slovakia, and that earlier campaigns used footholds in organisations such as border police, military, parliament and a meteorological institute, sender organisations whose attachments recipients would be more likely to open.

Technical analysis

Delivery and CVE-2026-21509. According to Trend, spear-phishing emails with subject lines related to "Hydro-meteorological Warnings", "Invitation to Military Training Program" or "Weapon Smuggling Alerts" carry a Rich Text Format (RTF) document that triggers CVE-2026-21509 when opened. Trend says an embedded Object Linking and Embedding (OLE) object referencing the Shell.Explorer.1 Component Object Model (COM) object makes Office connect to an attacker-controlled Web Distributed Authoring and Versioning (WebDAV) server and retrieve and execute a remote .lnk file, without user interaction beyond opening the document. It says domain registration for the WebDAV servers began on 12 January 2026, two weeks before the flaw's public disclosure on 26 January, a pattern it says suggests Pawn Storm had access to vulnerability details ahead of disclosure.

CVE-2026-21513, as Akamai and Trend report it. Akamai reported on 20 February 2026 that it correlated its analysis of Microsoft's patch with an observed in-the-wild exploit “attributed to the Russian state-sponsored threat actor APT28”. Akamai says the sample, a shortcut file first submitted to VirusTotal on 30 January 2026, is associated with infrastructure linked to APT28 and contacts wellnesscaremed[.]com, a domain it describes as attributed to APT28 and in extensive use for the campaign's multistage payloads; its post does not mention CVE-2026-21509. Trend credits Akamai with identifying shared command-and-control (C&C) infrastructure: it says the sample communicates with the same C&C domain used in the campaign exploiting CVE-2026-21509, suggesting a potential connection, and that the 11 days between its submission and Microsoft's patch of 10 February confirm zero-day exploitation in the wild. Trend says the executed .lnk file likely exploits CVE-2026-21513, which would make the attack a two-stage chain that executes payloads without user warnings, and that the shared infrastructure strongly suggests this linkage, but that it “has not independently confirmed that the .lnk files in this campaign exploit CVE-2026-21513”.

Microsoft's and CISA's records. Microsoft's update guide entries, last revised on 29 January and 10 February 2026, and the KEV catalogue as CISA published it on 26 March 2026 record the two flaws as below, with Microsoft's Common Vulnerability Scoring System (CVSS) 3.1 base scores.

CVE Microsoft's title and rating Released by Microsoft Exploited, per Microsoft Publicly disclosed, per Microsoft KEV vendor and product KEV date added KEV due date Known ransomware campaign use
CVE-2026-21509 Microsoft Office Security Feature Bypass Vulnerability; Important, CVSS 7.8 26 January 2026 Yes No Microsoft, Office 26 January 2026 16 February 2026 Unknown
CVE-2026-21513 MSHTML Framework Security Feature Bypass Vulnerability; Important, CVSS 8.8 10 February 2026 Yes Yes Microsoft, Windows 10 February 2026 3 March 2026 Unknown

For CVE-2026-21513, Microsoft says an attacker could convince a user to open a malicious Hypertext Markup Language (HTML) file or .lnk file delivered through a link, email attachment or download. The National Vulnerability Database (NVD) change histories, queried to this article's date, for CVE-2026-21509 and CVE-2026-21513 carry the same KEV dates.

PRISMEX. Trend says the name comes from the malware's steganographic characteristic of distributing the payload across the entire image, and that its investigation cannot confirm whether the threat actor developed the components as a unified framework, though it says they work together in coherent infection chains. Its introduction names three components, a dropper, a steganography loader and a Covenant Grunt implant; its analysis section lists four, adding PrismexSheet. Covenant, Trend notes, is an open-source .NET C&C framework.

Component Trend's description
PrismexSheet A highly obfuscated Excel dropper with Visual Basic for Applications (VBA) macros, the initial access vector in the September–December 2025 steganography campaign; it extracts payloads hidden in its own file and persists by hijacking a COM object that explorer.exe loads
PrismexDrop A native dropper that writes a malicious proxy dynamic-link library (DLL), EhStoreShell.dll, a steganography carrier, SplashScreen.png, and a task definition, office.xml; registers the DLL as the handler for a class identifier (CLSID) under HKEY_CURRENT_USER (HKCU); and uses a hidden scheduled task, OneDriveHealth, that runs once, one minute after infection, to restart explorer.exe
PrismexLoader A proxy DLL that masquerades as a legitimate Windows DLL, extracts the next stage from SplashScreen.png with a custom "Bit Plane Round Robin" algorithm and loads the .NET payload in memory inside explorer.exe
PrismexStager A Covenant Grunt stager that abuses the legitimate end-to-end encrypted cloud storage service Filen.io for C&C communications

Trend says the Bit Plane Round Robin algorithm is identical to code used in a previous Pawn Storm campaign from 2025 that targeted Ukrainian military drone lists, and that it has not been observed in public repositories. Trend says the C&C server delivers one of two primary payload chains, PRISMEX or a MiniDoor chain reported by Zscaler ThreatLabz, and that its analysis of the October 2025 campaign observed information-gathering tasks and a destructive wiper command that deleted all files under %USERPROFILE%.

ATT&CK mapping, per Trend. Trend's own MITRE ATT&CK table lists 15 techniques. The six below are those we could tie to a specific behaviour that Trend's body describes in these campaigns; the other nine include Mark-of-the-Web Bypass (T1553.005), which rests on the unconfirmed CVE-2026-21513 step.

Technique Behaviour, as Trend describes it
T1566.001 Phishing: Spearphishing Attachment RTF attachments that trigger CVE-2026-21509
T1059.005 Command and Scripting Interpreter: Visual Basic PrismexSheet's VBA macros
T1546.015 Event Triggered Execution: Component Object Model Hijacking CLSID hijacks by PrismexSheet and PrismexDrop
T1053.005 Scheduled Task/Job: Scheduled Task The hidden OneDriveHealth task
T1027.003 Obfuscated Files or Information: Steganography Payloads hidden in Portable Network Graphics (PNG) images and in PrismexSheet's own file
T1102 Web Service Filen.io used for C&C communications

Impact assessment

Trend assesses that the timing and targeting reflect “a shift in Russian military intelligence priorities toward operational and tactical disruption of Ukrainian logistics”, rather than purely strategic political intelligence. It says access to a rail logistics network or a national weather service could serve as a “beachhead for destructive attacks” timed to coincide with military operations, not only for data theft. We assess it is a realistic possibility that, for organisations in the sectors Trend lists, the most immediate exposure is theft of logistics and planning data, and that a compromised mailbox also endangers partners, because Trend describes Pawn Storm using footholds in trusted organisations as senders.

Indicators of compromise

A selection, defanged, from Trend's report and its indicators of compromise (IoC) list as archived. The list's other entries include further Secure Hash Algorithm 256-bit (SHA-256) file hashes, uniform resource locators (URLs), email addresses, file paths and mutex names. Akamai's post lists the same hash and domain.

Indicator Type Context, per source
aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa SHA-256 CVE-2026-21513 exploit sample, Akamai's document.doc.LnK; also in Trend's list
wellnesscaremed[.]com Domain The C&C domain Trend ties to the CVE-2026-21509 campaign and Akamai to the CVE-2026-21513 sample
wellnessmedcare[.]org, freefoodaid[.]com, longsauce[.]com Domain Listed by Trend, whose URL entries point to .lnk files on these hosts
193[.]187[.]148[.]169, 23[.]227[.]202[.]14, 72[.]62[.]185[.]31 Internet Protocol (IP) address Listed by Trend without further context
%PROGRAMDATA%\USOPublic\Data\User\EhStoreShell.dll File PrismexDrop's malicious proxy DLL
%PROGRAMDATA%\Microsoft OneDrive\setup\Cache\SplashScreen.png File PrismexDrop's steganography carrier
%TEMP%\Diagnostics\office.xml File PrismexDrop's task definition
%ProgramData%\USOShared\Logs\User\adwapi64.dll File PrismexSheet's payload DLL
HKCU\Software\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} Registry key PrismexDrop's COM hijack
OneDriveHealth Scheduled task PrismexDrop's trigger
filen[.]io, and the gateway, egest and ingest hosts on filen[.]io, filen[.]net and filen-1[.]net to filen-6[.]net Domain Listed by Trend; the legitimate service Trend says the malware abuses, so a match is a lead to investigate, not proof of compromise

Detection and hunting guidance

Trend recommends auditing HKCU\Software\Classes\CLSID for user-registered COM objects pointing to %PROGRAMDATA% or %TEMP%; monitoring for unusual common language runtime (CLR) initialisation in non-.NET native processes, particularly explorer.exe loading clr.dll or mscorlib.dll unexpectedly; and enabling the Microsoft-Windows-DotNETRuntime Event Tracing for Windows (ETW) provider to detect assembly loads from byte arrays rather than file paths. Its email advice includes strict attachment filtering for RTF documents and auditing Outlook VBA projects for unauthorised modifications.

Our own additions:

  • Search proxy and Domain Name System (DNS) logs back to at least September 2025, since when Trend says these campaigns have been active, for the domains and addresses above.
  • Look for the OneDriveHealth task and for explorer.exe being terminated and restarted soon after a .lnk file runs.
  • Alert on Office processes opening WebDAV connections to external hosts, the step Trend describes for CVE-2026-21509.

A generic version of Trend's registry hunt, to adapt to your schema:

-- User-registered COM servers pointing at ProgramData or Temp
SELECT event_time, host, registry_key, registry_value
FROM registry_events
WHERE lower(registry_key) LIKE 'hkcu%software%classes%clsid%inprocserver32%'
  AND (lower(registry_value) LIKE '%programdata%' OR lower(registry_value) LIKE '%temp%')
ORDER BY event_time;

Incident response guidance

These are our recommendations except where a source is named.

  1. Confirm that every Office installation has Microsoft's CVE-2026-21509 fix, with Office 2016 and 2019 at or above the builds Microsoft gives (16.0.5539.1001 and 16.0.10417.20095); that Microsoft 365 Apps and Office 2021 or later have been restarted, as Microsoft's service-side protection requires; and that Windows has the February 2026 security updates, which Akamai says fully mitigate CVE-2026-21513.
  2. On a host with any indicator above, capture memory before rebooting: Trend says the .NET payload never touches the filesystem and exists only in memory until the host process terminates.
  3. Remove the COM hijack, the scheduled task and the dropped files only after collection; Trend also advises auditing Outlook VBA projects.
  4. Treat the user's mailbox as compromised: review what it sent and warn its correspondents, given Trend's account of lures from trusted sender organisations.

Mitigation recommendations

Trend's immediate mitigations are to prioritise remediation of both CVE-2026-21509 and CVE-2026-21513 across the fleet and update Office and Windows to the latest builds; to restrict non-business-essential cloud storage services at the perimeter firewall and web proxy, keeping an allowlist of approved platforms and blocking unauthorised file-sharing services that lack verified business justification; to disable the Shell.Explorer.1 COM object via registry keys if patching is not immediately feasible; and to block macro execution for Office files from the internet (Mark of the Web). Microsoft's record describes registry keys that block the class identifier Trend gives for Shell.Explorer.1, but its two mitigation notes differ: one offers the keys to Office 2016 and 2019 customers for immediate protection, and the other says the keys do not apply to those versions. We therefore advise patching as the route for Office 2016 and 2019.

Historical context and related activity

Trend says it investigated the NotDoor ecosystem in early 2025 and assesses that the campaigns using PrismexStager likely represent a strategic expansion of it; it cites Zscaler ThreatLabz as reporting that the MiniDoor backdoor in this campaign is a NotDoor variant, which it says aligns with its own analysis. Trend says the use of the Covenant framework for final payloads has been documented by Ukraine's computer emergency response team (CERT-UA) and Sekoia.io since mid-2025, and that CERT-UA, Zscaler ThreatLabz and Synaptic Systems have also reported this campaign. Trend bases its attribution on technical artefacts, infrastructure overlaps and victimology, organised with an adapted Diamond Model and tested with Analysis of Competing Hypotheses (ACH). It names the unique steganography algorithm and the MiniDoor/NotDoor lineage as its primary attribution anchors. Our APT28 profile is in the archive: APT28.

Future outlook

This section is assessment. Akamai, in wording Trend repeats, says the vulnerable code path can be triggered through any component embedding MSHTML, so additional delivery mechanisms beyond LNK-based phishing should be expected. We assess it is a realistic possibility (B3) that Pawn Storm will use access in these sectors for destructive action as well as collection: Trend observed a destructive wiper command in the October 2025 campaign and says the strategic focus on supply chains, weather services and humanitarian corridors supporting Ukraine “may presage more destructive activities”.

Further reading