APT28 Weaponizes Microsoft Office Zero-Day in 3 Days

Russia Weaponizes Patch Tuesday Flaw in Record Time

Russia-linked threat actor APT28 (also tracked as Fancy Bear, UAC-0001, Forest Blizzard) weaponized Microsoft Office vulnerability CVE-2026-21509 within just three days of its disclosure in the February 2026 Patch Tuesday release. The campaign, dubbed "Operation Neusploit" by Zscaler ThreatLabz, targets Ukrainian government agencies and organizations across Eastern Europe.

Campaign Overview

Attack Chain

The attack leverages phishing emails with geopolitically-charged lures related to weapons smuggling and military training exercises:

1. Phishing email with weaponized Office document
2. CVE-2026-21509 bypasses security features (no macros needed)
3. WebDAV callback downloads shortcut file (.lnk)
4. Shortcut triggers PixyNetLoader
5. PixyNetLoader fetches and deploys COVENANT Grunt implant
6. MiniDoor steals emails via Outlook VBA injection
7. Full command-and-control established

Why This Exploit Is Dangerous

CVE-2026-21509 is a security feature bypass that requires no macros and no user interaction beyond opening the document. This bypasses the standard protections that block most Office-based attacks:

• No macro warning dialogs
• No Protected View triggers
• No Mark-of-the-Web checks
• Works on fully patched Office installations (pre-Feb Patch Tuesday)

Targets

More than 60 email addresses associated with Ukrainian central executive authorities were targeted, along with organizations in:

• Slovakia — Government ministries and defense contractors
• Romania — Military and diplomatic organizations
• Ukraine — Central government agencies, military command

Lure Themes

Malware Deployed

MiniDoor (Outlook Email Stealer)

A lightweight VBA-based implant injected into Outlook that:

• Monitors incoming and outgoing emails
• Exfiltrates message contents and attachments
• Forwards copies to attacker-controlled email accounts
• Operates silently within the user's Outlook process

COVENANT Grunt Implant

The COVENANT framework is an open-source C2 framework repurposed by APT28:

• Full remote access and command execution
• File upload/download capabilities
• Lateral movement within the network
• Persistence via scheduled tasks and registry modifications

Patch Status

CVE-2026-21509 was patched in the February 10, 2026 Patch Tuesday release. Organizations that have not yet applied the February updates are vulnerable.

Recommendations

1. Apply February Patch Tuesday updates immediately — CVE-2026-21509 is actively exploited
2. Block WebDAV traffic to external servers at the network perimeter
3. Hunt for PixyNetLoader indicators in endpoint telemetry
4. Monitor Outlook processes for unexpected VBA execution
5. Block COVENANT C2 infrastructure using published IOCs from Zscaler
6. Brief staff on phishing lures themed around military and diplomatic topics

Sources

• The Hacker News — APT28 Uses Microsoft Office CVE-2026-21509
• Zscaler ThreatLabz — Operation Neusploit
• Dark Reading — Russian Hackers Weaponize Microsoft Office Bug in Just 3 Days
• Help Net Security — Russian Hackers Exploiting CVE-2026-21509