SOC Prime Bias: Critical

27 Mar 2026 16:57
newspaper icon Trend Micro

Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

If PRISMEX activity is detected, immediately isolate affected systems, capture volatile memory for extraction of in-memory .NET assemblies, and hunt for the distinctive steganographic PNG payloads and COM hijack registry entries. Block all Filen.io subdomains and the wellnesscaremed.com domain, and apply IOC-based detection and blocking for the identified filenames and scheduled task.

Response

Organizations should patch CVE-2026-21509 and CVE-2026-21513 without delay, restrict access to unapproved cloud storage services, and disable the Shell.Explorer.1 COM object through the registry. Defenders should enforce macro restrictions, monitor COM registration under HKCU\\Software\\Classes\\CLSID, and review suspicious scheduled tasks such as OneDriveHealth. ETW logging should also be enabled to detect unexpected CLR loads inside explorer.exe.

Mitigation

Researchers at TrendAI identified the PRISMEX toolset components — PrismexSheet, PrismexDrop, PrismexLoader, and PrismexStager — and connected them to prior Pawn Storm activity. They found evidence that the attackers prepared infrastructure weeks before the vulnerabilities were publicly disclosed and documented use of a shared C2 domain, wellnesscaremed.com. The research also mapped the MITRE ATT&CK techniques used throughout the intrusion chain.

Investigation

Pawn Storm (APT28) has launched a campaign centered on a new malware toolkit called PRISMEX, targeting the Ukrainian defense supply chain as well as allied government and logistics organizations. The operation exploits two recently disclosed zero-day flaws, CVE-2026-21509 and CVE-2026-21513, while abusing legitimate cloud platforms for command and control. The toolset includes steganographic loaders, COM-hijacking for persistence, and a Covenant Grunt stager hosted on Filen.io. Detection remains challenging due to fileless execution and encrypted network traffic.

"graph TB %% Class definitions classDef action fill:#99ccff classDef exploit fill:#ffcc99 classDef file fill:#ffeb99 classDef malware fill:#ff9999 classDef tool fill:#cccccc classDef c2 fill:#ccffcc %% Nodes step1_phishing["<b>Action</b> – <b>T1566.001 Phishing: Spearphishing Attachment</b><br/>Adversaries send targeted RTF documents with malicious OLE objects to victims."] class step1_phishing action artifact_rtf["<b>File</b> – <b>Name</b>: Malicious RTF document<br/>Contains crafted OLE object"] class artifact_rtf file step2_vba["<b>Action</b> – <b>T1059.005 Command and Scripting Interpreter: Visual Basic</b><br/>Embedded VBA macro autou2011executes on document open."] class step2_vba action step3_exploit["<b>Exploit</b> – CVEu20112026u201121509 OLE bypass<br/>Macro contacts malicious WebDAV server and downloads .lnk"] class step3_exploit exploit artifact_lnk["<b>File</b> – <b>Name</b>: Malicious .lnk shortcut"] class artifact_lnk file step4_html["<b>Action</b> – <b>T1218.001 System Binary Proxy Execution: Compiled HTML File</b><br/>.lnk triggers CVEu20112026u201121513 in MSHTML, running embedded HTML payload."] class step4_html action artifact_html["<b>File</b> – <b>Name</b>: Embedded HTML payload"] class artifact_html file step5_com_hijack["<b>Action</b> – <b>T1546.009 Event Triggered Execution: AppCert DLLs</b><br/>Payload registers malicious DLL as InProcServer32 for a CLSID for persistence."] class step5_com_hijack action malicious_dll["<b>Malware</b> – <b>Name</b>: PrismexLoader DLL<br/>Masquerades as legitimate Windows DLL"] class malicious_dll malware step6_dll_hijack["<b>Action</b> – <b>T1574.001 Hijack Execution Flow: DLL</b><br/>Proxy DLL forwards legitimate calls while executing malicious code."] class step6_dll_hijack action step7_stego["<b>Action</b> – <b>T1027.003 Obfuscated Files or Information: Steganography</b><br/>Proxy DLL extracts .NET payload hidden in PNG using Bit Plane Round Robin."] class step7_stego action stego_png["<b>File</b> – <b>Name</b>: PNG image with hidden payload"] class stego_png file dotnet_payload["<b>Malware</b> – <b>Name</b>: .NET Covenant Grunt stager"] class dotnet_payload malware step8_c2["<b>Action</b> – <b>T1102 Web Service</b><br/>Stager communicates with Filen.io cloud storage subdomains for C2."] class step8_c2 action c2_filen["<b>C2</b> – Filen.io cloud storage"] class c2_filen c2 step9_exfil["<b>Action</b> – <b>T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage</b><br/>Collected data encrypted and uploaded to Filen.io."] class step9_exfil action step10_email["<b>Action</b> – <b>T1114.001 Email Collection: Local Email Collection</b><br/>Malware harvests Outlook mailbox files for reconnaissance."] class step10_email action outlook_data["<b>File</b> – <b>Name</b>: Outlook mailbox files (OST/PST)"] class outlook_data file %% Connections step1_phishing –>|delivers| artifact_rtf artifact_rtf –>|triggers| step2_vba step2_vba –>|executes| step3_exploit step3_exploit –>|downloads| artifact_lnk artifact_lnk –>|triggers| step4_html step4_html –>|runs| artifact_html artifact_html –>|loads| step5_com_hijack step5_com_hijack –>|registers| malicious_dll malicious_dll –>|loads| step6_dll_hijack step6_dll_hijack –>|extracts| step7_stego step7_stego –>|reads| stego_png stego_png –>|contains| dotnet_payload dotnet_payload –>|communicates with| step8_c2 step8_c2 –>|uses| c2_filen dotnet_payload –>|exfiltrates data via| step9_exfil step9_exfil –>|stores in| c2_filen step10_email –>|harvests| outlook_data dotnet_payload –>|collects email from| outlook_data %% Class assignments class step1_phishing,step2_vba,step3_exploit,step4_html,step5_com_hijack,step6_dll_hijack,step7_stego,step8_c2,step9_exfil,step10_email action class artifact_rtf,artifact_lnk,artifact_html,stego_png,outlook_data file class malicious_dll,dotnet_payload malware class step3_exploit step4_html step5_com_hijack step6_dll_hijack step7_stego exploit class c2_filen c2 "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:

    1. The adversary has obtained a malicious DLL (evil.dll) placed in a writable directory (e.g., C:Tempevil.dll).
    2. To achieve persistence, they select the CLSID {68DDBB56-9D1D-4FD9-89C5-C0DA2A625392} (one of the GUIDs tracked by the rule).
    3. Using built‑in reg.exe (or PowerShell), they set the default value of the InProcServer32 sub‑key to the path of the malicious DLL, thereby hijacking any COM activation of that CLSID.
    4. The registry change generates an EventID 13 entry with the exact TargetObject that matches the detection rule.

  • Regression Test Script:

    # -------------------------------------------------
# PrismexSheet COM Hijacking Persistence Simulation
# -------------------------------------------------
$guid = '{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}'
$dllPath = "C:Tempevil.dll"

# Ensure the malicious DLL exists (placeholder for test)
if (-not (Test-Path $dllPath)) {
    New-Item -Path $dllPath -ItemType File -Force | Out-Null
    Set-Content -Path $dllPath -Value "Malicious payload placeholder"
}

$regPath = "HKCU:SoftwareClassesCLSID$guidInProcServer32"

# Create the key if it does not exist
New-Item -Path $regPath -Force | Out-Null

# Set the default value to point to the malicious DLL
Set-ItemProperty -Path $regPath -Name '(Default)' -Value $dllPath

Write-Host "COM hijack persisted at $regPath -> $dllPath"

  • Cleanup Commands:

    # Remove the malicious COM registration
$guid = '{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}'
$regPath = "HKCU:SoftwareClassesCLSID$guid"
Remove-Item -Path $regPath -Recurse -Force

# Delete the dummy DLL
Remove-Item -Path "C:Tempevil.dll" -Force -ErrorAction SilentlyContinue

Write-Host "Cleanup completed."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free