APT28 Hackers Exploiting Microsoft Office 0-Day in the Wild: A Complete Cybersecurity Breakdown

The cybersecurity landscape has been shaken once again by one of the world’s most notorious state sponsored hacking groups. APT28, the Russia-linked advanced persistent threat group, has launched a sophisticated campaign targeting Central and Eastern Europe using a zero-day vulnerability in Microsoft Office. This alarming development highlights the ever-present dangers facing organizations worldwide and the critical importance of cybersecurity vigilance.

The Russia-linked state-sponsored threat actor known as APT28 (aka UAC-0001) has been attributed to attacks exploiting a newly disclosed security flaw in Microsoft Office as part of a campaign codenamed Operation Neusploit. This campaign represents a significant escalation in cyber warfare tactics and demonstrates the group’s continued evolution in sophisticated attack methodologies.

The campaign, tracked as Operation Neusploit, represents a significant escalation in APT28’s capabilities and demonstrates their continued focus on high-value targets across Ukraine, Slovakia, and Romania. Understanding the technical details, attack vectors, and defensive strategies against this threat is crucial for every organization seeking to protect their digital infrastructure.

Who is APT28? Understanding the Threat Actor

Background and Attribution

Fancy Bear is a Russian cyber espionage group. American cybersecurity firm CrowdStrike has stated with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. The UK’s Foreign and Commonwealth Office as well as security firms SecureWorks, ThreatConnect, and Mandiant, have also said the group is sponsored by the Russian government. In 2018, an indictment by the United States Special Counsel identified Fancy Bear as GRU Unit 26165.

The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the Russian government. Likely operating since 2007, the group is known to target government, military, and security organizations. It has been characterized as an advanced persistent threat.

Known Aliases and Designations

We assess that APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th special Service Centre (GTsSS) Military Intelligence Unit 26165. APT28 (also known as Fancy Bear, STRONTIUM, Pawn Storm, the Sednit Gang and Sofacy) is a highly skilled threat actor.

The group operates under numerous aliases in the cybersecurity community, including:

• Fancy Bear
• Sednit
• Sofacy Group
• Pawn Storm
• STRONTIUM
• Forest Blizzard
• Tsar Team
• FROZENLAKE
• GruesomeLarch
• Swallowtail

Historical Attack Patterns

The nation-state adversary group known as FANCY BEAR (also known as APT28 or Sofacy) has been operating since at least 2008 and represents a constant threat to a wide variety of organizations around the globe. They target aerospace, defense, energy, government, media, and dissidents, using a sophisticated and cross-platform implant.

Fancy Bear is classified by FireEye as an advanced persistent threat. Among other things, it uses zero-day exploits, spear phishing and malware to compromise targets. The group promotes the political interests of the Russian government, and is known for hacking Democratic National Committee emails to attempt to influence the outcome of the United States 2016 presidential elections.

CVE-2026-21509: The Microsoft Office Zero-Day Vulnerability

Technical Details of the Vulnerability

On January 26, 2026, Microsoft disclosed a critical zero-day vulnerability in its Office products, tracked as CVE-2026-21509. This vulnerability allows attackers to execute malicious code remotely, leading to full system compromise.

CVE-2026-21509 was published to address a security feature bypass vulnerability affecting Microsoft Office. This vulnerability was rated as “Important” and received a CVSS 3.1 score of 7.8.

The security issue arises from Microsoft Office’s reliance on untrusted inputs in security decisions. This allows unauthenticated local hackers to bypass a security feature. Specifically, CVE-2026-21509 allows threat actors to bypass OLE mitigations in Microsoft 365 and Office, exposing users to vulnerable COM/OLE controls.

How the Vulnerability Works

CVE-2026-21509 stems from how Microsoft Office handles RTF (Rich Text Format) files. APT28 exploits this by sending specially crafted RTF documents in phishing emails. When a user opens the document, the Office application improperly parses the RTF file, allowing the attacker to inject malicious code. This exploit bypasses document validation, enabling the execution of embedded payloads.

CVE-2026-21509 stems from reliance on untrusted inputs in a security decision in Microsoft Office, which allows unauthorized attackers to bypass a security feature (OLE mitigations in Microsoft 365 and Microsoft Office) locally. “The Preview Pane is not an attack vector. An attacker must send a user a malicious Office file and convince them to open it,” Microsoft noted. Successful exploitation thus hinges on user interaction, but tricking users into opening Office files has never been an insurmountable problem for attackers.

Affected Software Versions

The security feature bypass vulnerability, tracked as CVE-2026-21509, affects multiple Office versions, including Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft 365 Apps for Enterprise (the company’s cloud-based subscription service).

Operation Neusploit: The Attack Campaign Explained

Discovery and Attribution

Zscaler ThreatLabz said it observed the hacking group weaponizing the shortcoming on January 29, 2026, in attacks targeting users in Ukraine, Slovakia, and Romania, three days after Microsoft publicly disclosed the existence of the bug.

Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence.

Rapid Weaponization Timeline

Ukraine’s cyber defenders warn Russian hackers weaponized a Microsoft zero-day within 24 hours of public disclosure, targeting government agencies with malicious documents delivering Covenant framework backdoors. Russian state-sponsored hacking group APT28 used a critical Microsoft Office zero-day vulnerability, tracked as CVE-2026-21509, in less than a day after the vendor publicly disclosed the flaw, launching targeted attacks against Ukrainian government agencies and European Union institutions. Ukraine’s Computer Emergency Response Team detected exploitation attempts that began on January 27—just one day after Microsoft published details about CVE-2026-21509.

APT28 previously exploited Microsoft vulnerabilities within hours of disclosure, demonstrating consistent capability to rapidly weaponize newly discovered flaws.

Target Selection and Victimology

The campaign specifically targeted Ukraine, Slovakia, and Romania using social engineering lures written in English, Romanian, Slovak, and Ukrainian to increase effectiveness.

The file masqueraded as materials related to Committee of Permanent Representatives to the European Union consultations on Ukraine’s situation. On the same day, attackers impersonated Ukraine’s Ukrhydrometeorological Center, distributing emails with an attached DOC file named “BULLETEN_H.doc” to more than 60 email addresses. Recipients primarily included Ukrainian central executive government agencies, representing a coordinated campaign against critical government infrastructure.

The Multi-Stage Infection Chain

Initial Access Through Phishing

The attack begins when users receive socially engineered emails containing weaponized RTF documents. These messages are customized in English and local languages including Romanian, Slovak, and Ukrainian to increase the likelihood of successful infection. Once victims open these files, the vulnerability is silently triggered, allowing the threat actors to execute arbitrary code on the compromised system.

The infection begins with victims receiving an email with an RTF attachment that contains a weaponized exploit. When opened, the RTF file causes Microsoft Office to execute code that reaches out to threat actor infrastructure and downloads a dropper DLL. The DLL then executes the rest of the malicious chain.

Server-Side Evasion Techniques

The threat actors implemented sophisticated server-side evasion to limit exposure. Attacker-controlled servers deliver malicious DLL payloads only when requests originate from targeted geographic regions and include correct User-Agent HTTP headers. This geographic filtering prevents researchers outside target regions from easily obtaining samples.

APT28, known for targeting governments and stealing secrets, used social engineering lures in English, Romanian, Slovak, and Ukrainian. They hid malicious DLLs behind server checks only serving them from targeted regions with the right User-Agent header.

The Two Dropper Variants

The attack chains, in a nutshell, entail the exploitation of the security hole by means of a malicious RTF file to deliver two different versions of a dropper, one that’s designed to drop an Outlook email stealer called MiniDoor, and another, referred to as PixyNetLoader, that’s responsible for the deployment of a COVENANT Grunt implant.

MiniDoor: The Email Stealing Malware

Functionality and Design

In one path, the exploit delivered MiniDoor, a lightweight DLL that focused on email theft. The malware modified Windows registry settings to weaken Microsoft Outlook security controls, allowing it to quietly collect and exfiltrate email data.

ThreatLabz analysis reveals MiniDoor functions as a simplified version of NotDoor, previously attributed to APT28 by Lab52 researchers in September 2025. MiniDoor monitors the MAPILogonComplete event and systematically searches Inbox, RssFeeds, Junk, and Drafts folders for existing emails. The malware forwards discovered messages to two hardcoded attacker-controlled email addresses.

Relationship to Previous APT28 Tools

MiniDoor is assessed to be a stripped-down version of NotDoor (aka GONEPOSTAL), which was documented by S2 Grupo LAB52 in September 2025.

The design and functionality of MiniDoor closely resemble earlier APT28 tooling, aligning with the group’s established espionage-focused attacks.

PixyNetLoader: Advanced Persistent Access

Complex Infection Mechanism

The second dropper variant implements a more complex infection chain through PixyNetLoader, a previously undocumented tool that establishes persistence and deploys additional components. PixyNetLoader decrypts embedded payloads using a 71-byte rolling XOR key and drops three files: SplashScreen.png, EhStoreShell.dll, and office.xml.

In contrast, the second dropper, i.e., PixyNetLoader, is used to initiate a much more elaborate attack chain that involves delivering additional components embedded into it and setting up persistence on the host using COM object hijacking.

Persistence Mechanisms

It hijacks COM via registry for persistence in explorer.exe, then sets a “OneDriveHealth” task to restart explorer and delete itself. EhStoreShell.dll proxies legit exports, evades sandboxes with Sleep() checks and process validation, and extracts shellcode from PNG pixels using LSB steganography.

The second path involved a more elaborate chain that began with PixyNetLoader, which deployed additional payloads and established persistence using techniques such as DLL proxying and COM object hijacking. This loader ultimately installed a Covenant Grunt implant, used specifically in .NET command and control (c2) framework, giving the attackers sustained remote access through cloud-hosted C2 infrastructure.

Covenant Framework Deployment

The extracted shellcode, ultimately, is used to load an embedded .NET assembly, which is nothing but a Grunt implant associated with the open source .NET COVENANT command-and-control (C2) framework. It’s worth noting that APT28’s use of the Grunt Stager was highlighted by Sekoia in September 2025 in connection with a campaign named Operation Phantom Net Voxel.

Covenant is a post-exploitation framework similar to Cobalt Strike that provides attackers persistent command-and-control access. In this campaign, APT28 configured Covenant to use Filen.io, a legitimate cloud storage service, as command-and-control infrastructure. This technique, called living-off-the-land, makes malicious traffic appear legitimate and harder to detect.

Advanced Evasion Techniques Employed

In-Memory Execution and Encryption

“The entire chain is designed for resilience and evasion, utilizing encrypted payloads, legitimate cloud services for C2, in-memory execution, and process injection to minimize forensic artifacts,” Trellix said. “This multi-layered approach demonstrates APT28’s evolved tradecraft in maintaining persistent access while evading detection across enterprise environments.”

Living-Off-the-Land Tactics

Zscaler pins this on APT28 due to matching victim regions, MiniDoor’s NotDoor roots, Filen C2 abuse from past campaigns like Phantom Net Voxel, and TTPs like COM hijacking and DLL proxying.

Evasion includes mutexes, dynamic API hashing (DJB2), and time-based checks.

Steganography and Shellcode Injection

EhStoreShell.dll proxies legit exports, evades sandboxes with Sleep() checks and process validation, and extracts shellcode from PNG pixels using LSB steganography. The shellcode loads a .NET Covenant Grunt via CLR hosting, which phones home over Filen API as a C2 bridge.

Microsoft’s Emergency Response

Out-of-Band Security Update

On January 26th, 2026, Microsoft issued an emergency out-of-band security update to remediate a high-severity zero-day vulnerability in Microsoft Office.

Shortly after its January Patch Tuesday release, addressing 114 vulnerabilities, including a zero-day in Windows Desktop Manager (CVE-2026-20805), Microsoft rushed out an emergency out-of-band update to fix another bug under active exploitation. This time, attackers are targeting CVE-2026-21509, a Microsoft Office zero-day that allows threat actors to bypass built-in security features.

Patch Deployment Details

While Microsoft initially only released updates for Office 2021 and later, it didn’t take long for them to make them available for Microsoft Office 2016 and 2019 users. “Customers running Office 2021 and later will be automatically protected via a service-side change, but will be required to restart their Office applications for this to take effect,” Microsoft explained. “Customers running Microsoft Office 2016 and 2019 should ensure the update is installed to be protected from this vulnerability.”

Microsoft Defender Protections

“We recommend impacted customers follow the guidance on our CVE page. Additionally, Microsoft Defender has detections in place to block exploitation, and our default Protected View setting provides an extra layer of protection by blocking malicious files from the Internet,” a Microsoft spokesperson told BleepingComputer. “As a security best practice, we encourage users to exercise caution when downloading and enabling editing on files from unknown sources as indicated in security warnings.”

CISA Response and Federal Mandates

Known Exploited Vulnerabilities Catalog

In view of the exploitation cases confirmed by Microsoft, the flaw has been promptly added to the CISA’s Known Exploited Vulnerabilities (KEV) catalog, requiring US federal civilian agencies to patch it by February 16, 2026.

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-21509 to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agency to address the flaw by February 16, 2026.

Federal Agency Requirements

Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Detection and Indicators of Compromise

MITRE ATT&CK Mappings

Key file IOCs (select hashes; full list on Zscaler GitHub): MITRE mappings include T1566.001 (spearphishing), T1203 (exploitation), T1546.015 (COM hijacking), and T1114 (email collection).

Security Tool Detections

Zscaler blocks these via sandbox detections like RTF.Exploit.CVE-2026-21509 and Win32.Spyware.MiniDoor.

In response to these vulnerability disclosures, Talos is releasing a new SNORT® ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU.

What Security Teams Should Monitor

Security teams should monitor for registry modifications related to Outlook security settings and investigate any unauthorized VBA projects in Microsoft Outlook directories.

The agency specifically urges blocking or monitoring network connections to Filen cloud storage infrastructure, providing lists of domain names and IP addresses in its indicators of compromise section.

Critical Mitigation Strategies

Immediate Patch Deployment

Organizations should immediately apply the Microsoft security update released on January 26, 2026, to address CVE-2026-21509. Users should exercise caution when opening RTF documents from unknown sources.

ZScaler recommended that organizations prioritize patching for CVE-2026-21509, noting that APT28 exploited the flaw within days of Microsoft releasing fixes.

Registry Modifications for Older Versions

Until the updates are applied on Microsoft Office 2016 and 2019, organizations must implement the recommended registry key modifications as an interim mitigation. Instructions for the required registry changes are provided under Mitigations in Microsoft’s official patch documentation.

Additional Security Recommendations

CERT-UA recommends organizations immediately implement mitigation measures outlined in Microsoft’s advisory, particularly Windows registry modifications that prevent exploitation.

Understanding Zero-Day Threats in 2026

The Zero-Day Landscape

A zero-day exploit is one of the most dangerous weapons in a cybercriminal’s arsenal. Unlike typical cyber attacks that target known vulnerabilities, zero-day exploits strike at previously undiscovered weaknesses in software or hardware – giving defenders zero days to prepare. In this comprehensive guide, we’ll explore what makes these threats so dangerous and how organizations can protect themselves in 2026’s evolving threat landscape.

Microsoft products continue to be a juicy target for zero-day exploits, with 41 vulnerabilities identified as zero-days last year, 24 of which were leveraged for in-the-wild attacks, according to Tenable. The Windows operating system and Office components remain the primary attack vectors, with this trend persisting into 2026.

Nation-State Exploitation Speed

While countdown to exploitation typically starts with the first public PoC publication (not true zero-day), Chinese APTs have started exploiting these vulnerabilities within hours after disclosure, potentially reverse-engineering vendor patches to shorten the window for patching. While this technique is currently nation-state territory, its replication by RaaS groups is a potential development for 2026.

APT28’s Evolving Tradecraft

Previous Notable Campaigns

Fancy Bear (aka APT28 or Forest Blizzard) breached the network of a US organization using this method, which the researchers at Volexity are calling a “Nearest Neighbor” attack. “The threat actor accomplished this by daisy-chaining their approach.

Volexity first discovered the attack just ahead of Russia’s invasion of Ukraine in February 2022, when a detection signature Volexity had deployed at a customer site indicated a compromised server. Eventually, the researchers would determine that Fancy Bear was using the attack “to collect data from individuals with expertise on and projects actively involving Ukraine” from the Washington, DC-based organization.

Continuous Tool Development

According to security researchers, Fancy Bear weaponized crafted Office documents to exploit the flaw prior to widespread patch adoption, enabling stealthy code execution, payload delivery, and long-term intelligence collection.

The group is particularly adept at exploiting zero-day and n-day vulnerabilities in widely used software such as Microsoft Office, combining technical exploitation with well-crafted social engineering.

Campaign Evolution Analysis

The campaign demonstrates APT28’s continued evolution in tactics, techniques, and procedures by weaponizing CVE-2026-21509 shortly after disclosure and maintaining exploitation even after patch availability. ThreatLabz continues monitoring Operation Neusploit and collaborating with Microsoft to track this evolving threat.

Protecting Your Organization

Proactive Defense Strategies

Mitigating the risk of zero-day security exploits starts with strong cybersecurity hygiene. Keeping all software and systems up to date ensures that known vulnerabilities are patched, leaving fewer opportunities for exploitation. Using firewalls and intrusion detection systems adds an extra layer of defense by monitoring and controlling incoming and outgoing traffic. Employing reputable antivirus software with behavior-based detection can help identify and neutralize suspicious activity, even from unknown threats.

Incident Response Planning

Incident Response War Room: Establish a well-defined incident response plan that outlines protocols for detecting, containing, eradicating, and recovering from cyberattacks. Regularly simulate and refine your response strategies.

Network Segmentation and Wi-Fi Security

Because the attack highlights a new risk for organizations of compromise through Wi-Fi even if an attacker is far away, defenders “need to place additional considerations on the risks that Wi-Fi networks may pose to their operational security,” treating them “with the same care and attention that other remote access services, such as virtual private networks (VPNs),” the researchers observed. Recommendations for organizations to avoid such an attack include creating separate networking environments for Wi-Fi and Ethernet-wired networks, particularly where Ethernet-based networks allow for access to sensitive resources.

Administrative Access Controls

Recommendation: Apply a Risk Management framework to re-evaluate your security controls as if you have a malicious insider. Ask how your own management tools can be weaponized against you. This is critical for high-impact assets like hypervisors. Ensure that Multi-Factor Authentication (MFA) is mandatory for all administrative interfaces and privileged actions. Access to management consoles must be treated as a critical risk.

The Geopolitical Context

Russia Ukraine Cyber Warfare

The group operates on behalf of Russia’s GRU military intelligence agency and has conducted extensive operations targeting Ukraine since Russia’s 2022 invasion.

With APT28’s history of targeting government organizations and critical infrastructure, CVE-2026-21509 has raised serious concerns regarding the security of sensitive systems, especially in Ukraine and Eastern Europe.

Broader European Targeting

Victimology: The use of Romanian, Ukrainian, and English language content in the exploit RTFs suggest potential targets within Europe. European countries, especially those in Central and Eastern Europe, have been targeted previously by APT28.

CERT-UA discovered three additional malicious documents using similar exploits in late January 2026. Analysis of embedded URL structures and other technical indicators revealed these documents targeted organizations in EU countries.

Future Outlook and Predictions

Expected Campaign Continuation

“It is obvious that in the near future, including due to the inertia of the process or impossibility of users updating the Microsoft Office suite and/or using recommended protection mechanisms, the number of cyberattacks using the desc[ribed vulnerability will increase].”

Evolving Threat Landscape

As we approach 2026, the narrative is dominated by scary apocalyptic visions of autonomous AI swarms and machine-generated zero-days. What is truly dangerous is the mundane reality: the relentless speed of business adoption outpacing security maturity, and matured cybercrime playbooks that generate consistent revenue to the Ransomware-as-a-Service ecosystem.

Staying Ahead of Advanced Threats

The APT28 exploitation of CVE-2026-21509 serves as a stark reminder of the persistent threats facing organizations worldwide. This sophisticated campaign demonstrates the capabilities of nation-state actors and their ability to rapidly weaponize newly disclosed vulnerabilities.

Fancy Bear stands as a relentless and inscrutable adversary, but by exploring their tactics, motivations, and the intricate layers of their operations, we equip ourselves with the knowledge needed to thwart their ambitions.

Organizations must prioritize immediate patching of affected Microsoft Office products, implement robust email security controls, and maintain vigilant monitoring for indicators of compromise. The collaboration between security researchers, government agencies, and private organizations remains crucial in combating these advanced persistent threats.

The cybersecurity community continues to track Operation Neusploit and related APT28 activities, with ongoing efforts to protect potential targets and develop defensive measures against these sophisticated attack techniques.