APT28’s PixyNetLoader evolves with new steganographic tricks up to 2026
ExaTrack analyzed roughly 90 PixyNetLoader samples, identifying four sub‑families and a unified YARA rule. The latest 2026 variants use advanced PNG‑based steganography to hide a Covenant Grunt payload, with new C2 channels and delivery via CVE‑2026‑21509 exploits. The report includes IOCs, detection guidance, and a payload extraction script.