Apt28 Macromaze Includepicture Doc Tracking

Daniel Jeremiah@daniyyell

•updated Feb 23, 2026•2•0•47

YARA-L that detects multiple APT28, including MacroMaze persistence: schtasks creating a task that runs wscript/cscript with .vbs and batch in the user profile.