Tag: operation macromaze

1 Attack Reports | 0 Vulnerabilities

Attack reports

Operation MacroMaze: New APT28 Campaign Using Basic Tooling and Legitimate Infrastructure

Operation MacroMaze, attributed to APT28 (Fancy Bear), targets entities in Western and Central Europe from September 2025 to January 2026. The campaign utilizes basic tools and legitimate services for infrastructure and data exfiltration. Multiple documents with varying macro variants act as droppe…
fancy bear
exfiltration
persistence
html
webhook
macros
vbscript
2026-02-16
batch files
droppers
operation macromaze
Published: February 16, 2026
Downloadable IOCs: 7
Click here to see more Attack Reports