Pawn Storm Deploys PRISMEX Suite Targeting European Defense

The prolific Russian-aligned threat actor Pawn Storm (APT28, Forest Blizzard) has launched a sophisticated campaign involving a new interconnected malware suite dubbed PRISMEX. This operation, active since late 2025 and escalating in early 2026, primarily targets the defense supply chain, military logistics hubs, and humanitarian corridors supporting Ukraine across Central and Eastern Europe. The campaign is notable for its rapid weaponization of newly disclosed vulnerabilities, including the zero-day exploitation of CVE-2026-21513.

Technically, the campaign employs a multi-stage infection chain that begins with spear-phishing and progresses through OLE exploitation (CVE-2026-21509) to deliver steganographic payloads. The PRISMEX suite—consisting of specialized droppers, loaders, and stagers—evades detection by using a unique 'Bit Plane Round Robin' steganography algorithm and abusing legitimate cloud services like Filen.io for command-and-control. Evidence of destructive wiper commands suggests the actor's intent may extend beyond espionage to include operational sabotage.

This campaign represents a critical threat to government, military, and critical infrastructure sectors. The actor's ability to register infrastructure weeks before vulnerability disclosure indicates advanced intelligence and high operational tempo, necessitating immediate patching and proactive hunting for behavioral anomalies within Windows system processes like explorer.exe.