APT28’s PixyNetLoader uses PNG steganography to hide malware

The article details an analysis of the PixyNetLoader malware linked to the APT28 group, which uses steganography to hide payloads in PNG files. The malware is a DLL-based loader that exploits a specific vulnerability to install itself and execute a malicious payload from image pixels. Exatrack documented 23 variants of the malware over two years, categorizing them into four families, with Family C being the most advanced and stealthy.

Detection strategies include YARA rules and monitoring for unusual file behaviors. The analysis emphasizes the need for continuous vigilance against evolving threats from APT28.