TL;DR

APT28 launched a campaign named Operation MacroMaze using basic tooling and legitimate services exploitation in Europe from September 2025 to January 2026.

What happened

['APT28 initiated an attack campaign codenamed Operation MacroMaze', 'Campaign targeted specific entities in Western and Central Europe', 'Attack vectors include webhook-based macro malware']

Why it matters for ops

['Threat actors exploit legitimate services for cover', 'Basic tooling used to evade detection']

Mitigation

  • Implement strict webhook security policies
  • Enhance monitoring of macro-enabled file executions
  • Regularly update and patch legitimate services

Action items

  • Review security logs for suspicious webhook actions
  • Conduct a thorough assessment of macro usage in the environment
  • Apply necessary patches to mitigate known vulnerabilities

Detection IOCs

  • Suspicious webhooks activities
  • Unusual macro activity on office systems
  • Exploits targeting known legitimate services

Source link

https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html