A new intrusion campaign attributed to APT‑C‑20 (aka Fancy Bear, APT28) demonstrates the group’s continued refinement of stealthy, fileless techniques: weaponized Office documents that deploy a COM‑hijacking DLL.
Extract shellcode hidden via LSB steganography in a PNG, and use reflective loading to run an obfuscated C# remote‑control Trojan that communicates through the legitimate cloud storage service Filen.io.
The attack begins with a malicious readme.docm macro dropper that social‑engineers targets with a decoy document tailored to a defense ministry.
The macro is protected and encrypted; once enabled, it performs environment checks, copies itself to %TEMP%, and extracts two files into %PROGRAMDATA% a DLL (dnxstore.dll) and an innocuous PNG (EdgeLogo.png).
The macro registers a hijacked CLSID under HKEY_CURRENT_USER to point to the dropped DLL, establishing persistence by abusing COM lookup behavior triggered when explorer.exe initializes system COM objects.
Instead of an overt loader like regsvr32, the macro starts explorer.exe stealthily (hidden STARTUPINFO.wShowWindow), relying on the normal enumerations of COM classes to cause the system to load the attacker’s DLL.
This indirect sideloading provides a legitimate execution context (explorer.exe), reduces noisy API usage, and makes forensic attribution harder.
The DLL itself contains anti‑analysis checks it ensures it is running inside explorer.exe, avoids regsvr32 execution paths, and detects sandboxes by measuring sleep timing discrepancies.
dnxstore.dll implements a custom export resolution routine to frustrate static analysis and forwards some COM exports to the real stobject.dll to maintain process stability.
It then reads the embedded PNG and converts it to RGBA, extracting a hidden payload via least‑significant‑bit (LSB) steganography.
The chain, uncovered by 360 Advanced Threat Research Institute, blends mundane system behavior with layered encryption and in‑memory execution to evade detection and maintain long‑term access.
Fancy Bear Uses LSB Steganography
Using PBKDF2 (seeded from an internal key) to derive an AES‑256 key, the loader pulls Salt/IV from the pixel stream, decrypts a 64‑byte header that includes offset and size metadata, extracts the encrypted core payload, and decrypts it.
The registry key HKEY_CURRENT_USER\Software\Classes\CLSID{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}\InProcServer32 to point to dnxstore.dll, thus completing the COM hijacking.
That decrypted payload is shellcode whose job is to load the next‑stage component entirely in memory.
The shellcode performs reflective loading of a highly obfuscated C# remote‑control Trojan (Publish.exe).
AES-256 key is derived using the PBKDF2 algorithm, and then the target PNG image is loaded and converted to RGBA format to extract the pixel stream.
The C# implant initializes AES and constructs encrypted JSON‑formatted beacons that include a GUID derived from system artifacts, metadata, IVs, and HMACs, then applies XOR+Base64 layering before transmission.
Communication is staged through Filen.io gateways (gateway.filen.io, gateway.filen.net), offering resilience via multiple nodes and blending C2 traffic with legitimate cloud storage API calls.
The implant polls for commands, supports key negotiation with two‑way handshake, and executes further payloads via in‑memory reflective loading achieving fileless persistence and minimizing disk artifacts.
This campaign showcases several operational practices to note for defenders: decoy macros with encrypted code to delay analysis, COM hijacking combined with explorer.exe side‑loading to achieve stealthy execution.
LSB steganography inside ostensibly benign images for payload transport, and reflective loading of managed code with cloud‑based C2 for resiliency and blend‑in.
Mitigations include disabling macros by default, hardening Office macro policies, monitoring COM CLSID registrations under user hives, auditing explorer.exe child loads, inspecting PNG files for abnormal metadata or pixel entropy, and network allowlisting for unexpected cloud storage patterns.
Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide
 demonstrates the group’s continued refinement of stealthy, fileless techniques.){kind=link}