Fancy Bear Uses LSB Steganography and Reflective Loading to Run C# Remote-Control Trojan

A new intrusion campaign attributed to APT‑C‑20 (aka Fancy Bear, APT28) demonstrates the group’s continued refinement of stealthy, fileless techniques: weaponized Office documents that deploy a COM‑hijacking DLL. Extract shellcode hidden via LSB steganography in a PNG, and use reflective loading to run an obfuscated C# remote‑control Trojan that communicates through the legitimate cloud storage […]

The post Fancy Bear Uses LSB Steganography and Reflective Loading to Run C# Remote-Control Trojan appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.