APT28 Macro Malware Campaign Targets Europe with Sophisticated Attacks

Post Views: 154

Operation MacroMaze: A Novel Macro Malware Strain

A recent campaign attributed to the Russian state-sponsored threat actor APT28 has targeted organizations in Western and Central Europe with a novel macro malware strain. Dubbed Operation MacroMaze, the campaign ran from September 2025 to January 2026 and employed a webhook-based approach to infect victims.

Attack Vector and Tactics

The attack vector involved spear-phishing emails containing documents with malicious XML files. The “INCLUDEPICTURE” field in these files pointed to a URL hosted on a compromised site, which delivered the initial payload.

According to the researchers, the attackers relied on simple yet effective tools, including batch files, VBS launchers, and HTML code, to maintain stealth.

Researchers from S2 Grupo’s LAB52 threat intelligence team discovered that the macros used in the campaign underwent subtle changes over time, with later versions incorporating keyboard simulation techniques to evade detection.

Stealthy Tactics

They leveraged hidden browser sessions, cleaned up artifacts, and outsourced payload delivery and data exfiltration to widely used webhook services. This approach allowed the attackers to remain under the radar while still achieving their objectives.

Conclusion

The Operation MacroMaze campaign highlights the ongoing threat posed by APT28, which continues to adapt and refine its tactics to evade detection. As the threat landscape evolves, organizations must remain vigilant and proactive in their defenses to counter such sophisticated attacks.