Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities

MITRE Techniques

• [T1566.001 ] Spearphishing Attachment – Delivered malicious RTF attachments to targets: (‘Spear-phishing emails are sent to targeted individuals with subject lines related to “Hydro-meteorological Warnings,” “Invitation to Military Training Program,” or “Weapon Smuggling Alerts.”‘)
• [T1059.001 ] PowerShell – Listed as an execution technique in mapping (reported usage pattern): (‘T1059.001 – PowerShell’)
• [T1059.005 ] Visual Basic – VBA macros in malicious Excel droppers used to extract and deploy payloads: (‘PrismexSheet: A malicious Excel dropper with VBA macros that extracts payloads embedded within the file itself using steganography techniques.’)
• [T1204.001 ] User Execution: Malicious Link – Malicious .lnk shortcuts retrieved and executed via WebDAV after RTF OLE instantiation: (‘this vulnerability forces the host application to automatically initiate an outbound connection… to retrieve and execute a remote .lnk (shortcut) file’)
• [T1546.015 ] Component Object Model Hijackin – Persistence via user-registered COM InProcServer32 pointing to dropped DLLs: (‘PrismexSheet establishes persistence by hijacking a COM object… By rewriting the InProcServer32 value to point to the dropped malicious DLL (adwapi64.dll)’)
• [T1053.005 ] Scheduled Task – Scheduled task used as a trigger to restart explorer.exe and load hijacked COM: (‘A hidden scheduled task (“OneDriveHealth”) runs once, one minute after infection, executing a command sequence that terminates and restarts explorer.exe.’)
• [T1574.002 ] DLL Side-Loading – Proxy DLL technique forwards legitimate exports while executing malicious code to avoid crashes: (‘This component masquerades as the legitimate Windows DLL like EhStorShell.dll. It functions as a Proxy DLL, forwarding legitimate function exports to the real system DLL’)
• [T1027.003 ] Steganography – Payloads embedded and scattered across images using a “Bit Plane Round Robin” extraction algorithm: (‘The loader cycles through the entire image buffer extracting the LSB of every byte before moving to the next bit plane.’)
• [T1562.001 ] Disable or Modify Tools – Bypass of platform defenses and Protected View to circumvent security features: (‘effectively bypassing Protected View and standard OLE security prompts.’)
• [T1055 ] Process Injection – In-memory CLR hosting and execution of .NET assemblies inside explorer.exe to avoid filesystem artifacts: (‘the malicious code executes within explorer.exe (a highly trusted system process), and the payload never touches the filesystem’)
• [T1553.005 ] Mark-of-the-Web Bypass – Exploits used to bypass Mark-of-the-Web and IE Enhanced Security: (‘likely exploits CVE-2026-21513 … to bypass Mark of the Web and IE Enhanced Security Configuration.’)
• [T1114.001 ] Local Email Collection – Collection technique listed in mapping relating to email-based targeting and follow-on collection: (‘T1114.001 – Local Email Collection’)
• [T1071.001 ] Web Protocols – Use of WebDAV and web protocols to retrieve .lnk payloads from attacker-controlled servers: (‘the attacker forces the host application to automatically initiate an outbound connection… to retrieve and execute a remote .lnk (shortcut) file’)
• [T1102 ] Web Service – Abuse of Filen.io cloud service for command-and-control and data transfer: (‘The malware abuses the legitimate end-to-end encrypted cloud storage service Filen.io for C&C communications.’)
• [T1048.003 ] Exfiltration Over Alternative Protocol – Use of ingest/egest Filen.io endpoints to exfiltrate data and retrieve payloads: (‘Ingress domains: ingest.filen.io (for data exfiltration)’)