exatrack.comPublished
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
Excerpt
Key takeaways
Analysis of ~90 PixyNetLoader samples and grouping them into 4 sub-families using code similarities sharing
Enabling unified detection through a single YARA rule
Exposing the latest steganography mechanisms used in the 2026 March-April versions
Provinding PNG payload extraction script, IOCs, detection guidance and samples list
In this article, we will examine the evolutions of the APT28 PixyNetLoader code family, and how, by analyzing approximately 90 samples and studying the shared code between them, we can identify 4 major different sub-families that we will briefly detail, and produce a single YARA rule to match all of these codes.
We will then fo…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by exatrack.com on blog.exatrack.com.
Mentioned in the excerpt
More from exatrack.com1
- Under the Hood - LotusLite: Believe me I am MustangPandaexatrack.com · Published 9 Jun
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
