Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics

Multiple high-risk cyber incidents and disclosures reported: Russia-linked APT28 (aka Fancy Bear) is running a spear-phishing campaign against Ukraine and allied infrastructure deploying a new malware suite named PRISMEX with advanced stealth (steganography) for espionage and C2. Active exploitation of a critical Flowise remote code execution vulnerability (CVE-2025-59528, CVSS 10) is observed; CISA added a Fortinet FortiClient EMS flaw (CVE-2026-35616, CVSS 9.1) to its KEV catalog and out-of-band patches were issued. Other notable events include Iran-linked actors targeting internet-exposed/​