Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure

Summary

APT28 (Fancy Bear) ran a spear-phishing operation dubbed Operation MacroMaze targeting organizations across Western and Central Europe. The lure used weaponized Word documents with macro droppers that pulled additional scripts and moved stolen data out through legitimate webhook services. The chain sticks to low-friction tooling—VBS, batch scripts, and Microsoft Edge launched in hidden or headless mode—while keeping infrastructure on the public service webhook.site.

Investigation

Lab52 tracked four macro variants between September 2025 and January 2026, noting iterative changes in dropper behavior, scheduled-task persistence, and browser-driven exfiltration. Analysts highlighted recurring indicators including INCLUDEPICTURE fields, GUID-style filenames, and SendKeys-based automation. They also extracted relevant artifacts, URLs, and the specific scheduled-task creation flow used to maintain access.

Mitigation

Turn off automatic macro execution in Office and apply strict Outlook attachment handling. Monitor for suspicious scheduled-task creation and atypical Microsoft Edge launches in headless or off-screen modes. Block or alert on outbound traffic to webhook.site and similar public webhook platforms. Use application allow-listing to restrict execution of unknown VBS and batch files.

Response

If activity is detected, isolate the host, preserve the malicious document and related artifacts, and hunt for the created scheduled task and dropped files. Capture network telemetry to identify exfiltration endpoints and remove any malicious scheduled tasks. Perform forensic scoping for credential theft and notify stakeholders. Update detections to cover the observed IOCs and behavioral patterns.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An APT28‑style malicious Word macro is delivered via phishing. When the document is opened, the macro runs a small VBScript that creates a WScript.Shell object. This object is then used to launch cmd.exe with a payload that writes a base‑64‑encoded PowerShell reverse shell to a temporary file and executes it. The sequence generates two process‑creation events that satisfy the Sigma rule:

  1. wscript.exe (or cscript.exe) runs the VBScript containing WScript.Shell.
  2. The same VBScript calls WScript.Shell.Run "cmd.exe /c powershell -nop -w hidden -EncodedCommand …" which spawns cmd.exe.

  The child‑parent relationship and the presence of WScript.Shell in the command line are the exact indicators the rule looks for.

• Regression Test Script:

  # -------------------------------------------------------
  # MacroMaze simulation – launches wscript.exe → cmd.exe
  # -------------------------------------------------------
  # 1. Create a temporary VBS that uses WScript.Shell to run cmd.exe
  $vbsContent = @"
  Set sh = CreateObject("WScript.Shell")
  sh.Run "cmd.exe /c echo Malicious payload executed > %TEMP%payload.txt"
  "@
  $vbsPath = "$env:TEMPmacromaze.vbs"
  $vbsContent | Set-Content -Path $vbsPath -Encoding ASCII
  
  # 2. Execute the VBS via wscript.exe (will generate the desired telemetry)
  Start-Process -FilePath "wscript.exe" -ArgumentList "`"$vbsPath`"" -WindowStyle Hidden
  
  # Optional: pause to allow SIEM to ingest events
  Start-Sleep -Seconds 5
  # -------------------------------------------------------

• Cleanup Commands:

  # Remove the temporary VBS and payload file
  Remove-Item -Path "$env:TEMPmacromaze.vbs" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPpayload.txt" -ErrorAction SilentlyContinue