Meta News

Pawn Storm Campaign Uses PRISMEX to Target Government and Critical Infrastructure

Summary: Trend Micro Research details a recent Pawn Storm campaign targeting government and critical infrastructure entities with PRISMEX, an advanced malware suite that employs steganography and exploits recently disclosed vulnerabilities.

Advanced Threats & Targeted Attacks
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

In this blog, Trend Micro Research discusses the latest Pawn Storm campaign, which utilizes a sophisticated malware suite known as PRISMEX to target government and critical infrastructure entities in Ukraine and its allies. The attack leverages advanced steganography, cloud abuse, and email-based backdoors against the Ukrainian defense supply chain.

PRISMEX combines several techniques for command and control: it uses advanced steganography, hijacks component object model (COM) processes, and abuses legitimate cloud services. Pawn Storm has exploited multiple vulnerabilities, including a confirmed Windows zero-day (CVE-2026-21513). The .lnk files obtained through CVE-2026-21509 may be linked to CVE-2026-21513 based on shared command-and-control infrastructure identified by Akamai, though Trend Micro has not independently confirmed this connection.

The campaign's preparations suggest advance knowledge of the vulnerabilities. Both espionage and potential sabotage functionality were observed, including wiper commands. This blog provides organizations with risk management guidelines to protect against similar cyber threats.

Infrastructure preparations began two weeks before the vulnerability disclosure, indicating sophisticated planning and resource allocation.

Key facts

  • Pawn Storm has deployed PRISMEX, an advanced malware suite targeting government and critical infrastructure.
  • The campaign uses steganography, cloud abuse, and exploits zero-day vulnerabilities.
  • Infrastructure preparations began two weeks before the vulnerability disclosure.
  • PRISMEX components include a dropper (PrismexDrop), loader (PrismexLoader), and implant (PrismexStager).

Why it matters

The deployment of PRISMEX by Pawn Storm demonstrates the group's advanced capabilities in exploiting newly disclosed vulnerabilities and rapidly weaponizing them for espionage and sabotage. This campaign highlights the ongoing threat to critical infrastructure and government entities from state-aligned APT groups.

X profile@trendaisecurityhttps://x.com/trendaisecurity
Embedded content for: Pawn Storm Campaign Uses PRISMEX to Target Government and Critical Infrastructure
Tags:
cybersecurity APT Pawn Storm PRISMEX

Structured details

  • Industry: cybersecurity
  • Source type: media
  • Claim status: confirmed
  • Verification: claimed_by_source
  • Entities: Pawn Storm, PRISMEX, Trend Micro Research, Akamai

Source: https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html

Published on