Explorer COM Hijacking Attack Loads Shellcode From AES-Encrypted Steganographic PNG

A highly sophisticated cyberespionage campaign has been discovered utilizing advanced persistence techniques and encrypted steganography to infiltrate targeted networks.

The 360 Advanced Threat Research Institute said in a report shared with Cyber Security News (CSN) that the notorious state-sponsored hacking group APT-C-20, widely known as APT28 or Fancy Bear, is actively orchestrating this stealthy operation.

Active since 2004, this elite hacking collective is deploying a complex infection chain that relies on malicious macros, covert manipulation of system processes, and legitimate cloud services to establish a fileless presence on compromised machines.

The attack sequence begins when a victim opens a specially crafted, macro-enabled document named readme.docm, which displays scrambled text to trick the user into enabling active content.

Once activated, the document displays a fake lure related to an Eastern European defense ministry.

To avoid immediate suspicion during the execution phase, the malicious document employs visual deception by manipulating the coordinates of underlying visual objects within the file.

This effectively hides the initial decoy and displays harmless content while the background payload silently executes.

Explorer Hijacking Loads Shellcode

Before dropping any payloads, the macro connects to external infrastructure to perform initial network reconnaissance. It then extracts and drops critical malicious components into specific system directories.

The primary files include a malicious library named dnxstore.dll and a seemingly benign image named EdgeLogo.png, which are placed within hidden program data folders to evade casual detection.

The malware also gathers basic system information, such as the operating system architecture and installed software versions. It encrypts this data with a simple single-byte cipher before concealing it in a hidden text box.

The primary method for establishing persistent access in this campaign relies on a highly effective Component Object Model hijacking technique.

The malicious macro modifies the Windows registry to redirect a specific class identifier, known as 68DDBB56-9D1D-4FD9-89C5-C0DA2A625392, which is normally associated with the system’s unexpected shutdown diagnostic component.

By altering the registry path to point to the newly dropped dnxstore.dll payload, the attackers guarantee that their malicious code will execute whenever the operating system requests this standard application object.

To trigger this execution without raising alarms, the malware strictly avoids using highly scrutinized commands. Instead, it uses standard system functions to silently launch the Windows Explorer process in the background with a hidden window, 360 said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.