#PixyNetLoader
ExaTrack: APT28's PixyNetLoader has hidden implants inside PNG images since 2024, with about 23 versions so far. YARA rules and host indicators are out.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/apt28-p...
November 3, 2026 at 4:02 PM
~Malpedia~
APT28 continues targeting Ukrainian military logistics with updated PixyNetLoader, evading prior detections and changing persistence.
-
IOCs: 125abe1a497067a61011eb6072b1b3d91d3f0b658ed20a99734f0341d9cbdd6a, {0a556d98-cfee-4d84-82a7-00377f939198}
-
#APT28 #Malware #ThreatIntel
APT28 PixyNetLoader Update
malpedia.caad.fkie.fraunhofer.de
October 25, 2026 at 4:05 AM
APT28 hides Covenant Grunt in PNG pixels and runs C2 through Filen cloud storage. https://intel.threadlinqs.com/threat/TL-2026-4418?utm_source=bluesky #ThreatIntel #PixyNetLoader #Covenant #APT28
October 24, 2026 at 10:15 PM
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
blog.exatrack.com
June 3, 2026 at 3:09 PM
Russian APT28 Launches Swift Cyberattack on European Maritime and Transport Sectors

In a chilling display of cyber aggression, the notorious Russian-linked hacking group APT28 has launched a concentrated 72-hour attack targeting Europe’s maritime and transport infrastructure. Exploiting the…
Russian APT28 Launches Swift Cyberattack on European Maritime and Transport Sectors
In a chilling display of cyber aggression, the notorious Russian-linked hacking group APT28 has launched a concentrated 72-hour attack targeting Europe’s maritime and transport infrastructure. Exploiting the recently disclosed Microsoft Office vulnerability CVE-2026-21509, the campaign leveraged sophisticated malware payloads including MiniDoor, PixyNetLoader, and the Covenant backdoor, distributed through the Filen cloud service. The attack underscores the increasing geopolitical focus on critical infrastructure and the persistent evolution of cyber threats in the transport sector.
undercodenews.com
February 6, 2026 at 10:13 AM
Russia-linked UAC-0001 exploited CVE-2026-21509 in malicious Office RTFs to deliver MiniDoor and PixyNetLoader targeting users in Ukraine, Slovakia, and Romania.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
February 3, 2026 at 9:39 AM
Tracking the evolution of APT28 PixyNetLoader --
https://
blog.exatrack.com/Tracking_APT28
_PixyNetLoader
…

🔁 RT @AndreGironda | reposted by @hasherezade
https://x.com/AndreGironda/status/2061433807690178700
June 2, 2026 at 12:11 PM