Russia's 'Fancy Bear' APT Continues Its Global Onslaught

Why It Matters

The ongoing operations underscore persistent threats to critical infrastructure and highlight the need for robust, baseline security controls across both public and private sectors.

Key Takeaways

• Fancy Bear used Prismex malware targeting Ukraine’s defense supply chain
• NTLMv2 hash‑relay attacks leveraged Outlook CVE‑2023‑23397
• GRU‑linked actors compromised TP‑Link routers via CVE‑2023‑50224
• Attackers still rely on 20‑year‑old DNS hijacking techniques
• MFA, patching, and router firmware updates stop many Fancy Bear vectors

Pulse Analysis

Fancy Bear, the Russian GRU‑backed APT28, has demonstrated an unsettling blend of longevity and adaptability, as highlighted by Trend Micro’s recent disclosures. The Prismex campaign, which weaponized both a confirmed Windows zero‑day (CVE‑2026‑21513) and an Office flaw (CVE‑2026‑21509), targeted the defense supply chain of Ukraine and its NATO allies, while a parallel NTLMv2 hash‑relay operation abused the Outlook vulnerability CVE‑2023‑23397 to harvest credentials across Europe and the Americas. These findings illustrate how the group layers novel exploits atop time‑tested intrusion methods, keeping defenders on a constant chase.

Beyond malware, the threat actor’s focus on network infrastructure has raised alarm bells among regulators. FBI alerts and warnings from the U.K.’s NCSC detail a wave of compromised TP‑Link SOHO routers (CVE‑2023‑50224) that were re‑configured to redirect DNS traffic, facilitating man‑in‑the‑middle attacks on encrypted sessions. Such router hijacking, a technique dating back two decades, shows Fancy Bear’s willingness to exploit low‑cost, high‑impact vectors that bypass traditional perimeter defenses. The global reach—from European ministries to South American energy firms—underscores the group’s strategic alignment with Russian geopolitical objectives.

For organizations, the takeaway is clear: sophisticated APTs are not invincible, and basic hygiene can blunt many of their moves. Multifactor authentication thwarts password‑spraying, timely patching closes the CVE‑2026‑21509 and Outlook gaps, and regular firmware updates eliminate router‑based footholds. Smaller enterprises should augment these fundamentals with managed detection services or sector‑specific ISAC memberships to gain visibility into lateral movement. Meanwhile, adopting zero‑trust architectures and just‑in‑time access limits the damage if an initial breach occurs, turning Fancy Bear’s preferred low‑effort pathways into dead ends.