ExaTrack says APT28's phishing with malicious XLS and DOC files continues to target Ukrainian military logistics. PixyNetLoader is a DLL that pulls a Covenant Grunt payload out of a companion PNG with LSB steganography. The Grunt uses the legitimate FILEN service for command and control. ExaTrack thinks the July update, which changed string encryption and the AES key handling, was a reaction to its June write-up; its public YARA rules no longer match.

• Persistence (September and later): HKCU\Software\Classes\CLSID\{0a556d98-cfee-4d84-82a7-00377f939198}, which overrides the Default Associations Profile Handler in shell32.dll. The DLL forwards exports to the real shell32 and only runs inside explorer.exe. An earlier sample used HKCU\...\CLSID\{30d49246-d217-465f-b00b-ac9ddd652eb7}\InProcServer32 (normally IDStore.dll).
• DLL paths: C:\ProgramData\Microsoft\DeviceSync\DNX\dnxstore.dll, %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\PSReadLineCore.dll, %APPDATA%\Microsoft\Internet Explorer\UserData\Low\db\uimanager.dll.
• PNG paths: %APPDATA%\Microsoft\Network\Cache\icon.png, C:\ProgramData\Microsoft\DeviceSync\Edge\wallpaper.png.
• Newest sample (Oct 13): SHA256 765a10350827f59d4e6f006fe89faacce2dbe3c839a6af3acc36d4df4b418993; the post lists eight earlier hashes back to May.

Either CLSID existing under a user's Classes key is abnormal; if present, its default value should point to the legitimate system DLL.