---
title: Hunt: APT28's PixyNetLoader keeps hitting Ukrainian military logistics; its July build broke public YARA rules and since September it hides behind a per-user CLSID that shadows a shell32 handler | ctxsec
url: https://ctxsec.com/items/hunt-apt28-pixynetloader-shell32-clsid-hijack
description: ""
status: "vendor research (ExaTrack, Oct 15)"
published: 2026-10-28
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-apt28-pixynetloader-shell32-clsid-hijack.md)

vendor research (ExaTrack, Oct 15)

2026-10-28

### Hunt: APT28's PixyNetLoader keeps hitting Ukrainian military logistics; its July build broke public YARA rules and since September it hides behind a per-user CLSID that shadows a shell32 handler

ExaTrack says APT28's phishing with malicious XLS and DOC files continues to target Ukrainian military logistics. PixyNetLoader is a DLL that pulls a Covenant Grunt payload out of a companion PNG with LSB steganography. The Grunt uses the legitimate FILEN service for command and control. ExaTrack thinks the July update, which changed string encryption and the AES key handling, was a reaction to its June write-up; its public YARA rules no longer match.

- **Persistence (September and later):** `HKCU\Software\Classes\CLSID\{0a556d98-cfee-4d84-82a7-00377f939198}`, which overrides the Default Associations Profile Handler in shell32.dll. The DLL forwards exports to the real shell32 and only runs inside `explorer.exe`. An earlier sample used `HKCU\...\CLSID\{30d49246-d217-465f-b00b-ac9ddd652eb7}\InProcServer32` (normally IDStore.dll).
- **DLL paths:** `C:\ProgramData\Microsoft\DeviceSync\DNX\dnxstore.dll`, `%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\PSReadLineCore.dll`, `%APPDATA%\Microsoft\Internet Explorer\UserData\Low\db\uimanager.dll`.
- **PNG paths:** `%APPDATA%\Microsoft\Network\Cache\icon.png`, `C:\ProgramData\Microsoft\DeviceSync\Edge\wallpaper.png`.
- **Newest sample (Oct 13):** SHA256 `765a10350827f59d4e6f006fe89faacce2dbe3c839a6af3acc36d4df4b418993`; the post lists eight earlier hashes back to May.

Either CLSID existing under a user's Classes key is abnormal; if present, its default value should point to the legitimate system DLL.

Sources: [ExaTrack: APT28's PixyNetLoader campaign Update (Oct 15)](https://www.exatrack.com/publications/pixynetloader-campaign-update.html)