APT28 Phantom Net Voxel - Steganography Image Drop from Office

Daniel Jeremiah@daniyyell

•updated Feb 6, 2026•1•0•23

This rule detects the creation of specific image files (windows.png, koala.png, or Default.png) in common application data directories (AppData\Local\ or ProgramData\). The creation event must be initiated by Microsoft Office applications (WINWORD.EXE, EXCEL.EXE) or prnfldr.dll. This activity is indicative of APT28's Phantom Net Voxel operation, which uses steganography to embed shellcode within these image files.