APT28 Weaponizes Microsoft Office Zero-Day Within 72 Hours, Deploying Steganographic Loaders and Cloud-Based C2 Across Six NATO-Adjacent Countries
Russia's APT28 exploited CVE-2026-21509, a Microsoft Office OLE bypass, within 72 hours of disclosure to hit military targets across six NATO-adjacent countries with steganographic loaders and cloud-based C2.
Overview
Russia’s GRU-affiliated threat group APT28 weaponized a critical Microsoft Office vulnerability within approximately 72 hours of its public disclosure, launching a coordinated espionage campaign against military and government targets in at least six countries. The campaign, tracked by Zscaler ThreatLabz as Operation Neusploit, exploits CVE-2026-21509 — a high-severity OLE security bypass rated CVSS 7.8 — to deliver multi-stage malware through specially crafted RTF documents that require no macros and minimal user interaction beyond opening the file, according to The Hacker News.
Microsoft released an out-of-band patch for the vulnerability on January 26, 2026. By January 29, Zscaler ThreatLabz observed active exploitation in the wild. Trellix researchers Pham Duy Phuc and Alex Lanstein published a detailed technical breakdown on February 4, confirming two distinct infection chains branching from the same initial exploit, as reported by CSO Online.
The Exploit and Infection Chain
CVE-2026-21509 allows an attacker to bypass Office’s OLE security restrictions, exposing unsafe COM controls to execution. The vulnerability was discovered jointly by Microsoft’s Security Intelligence Center, its Security Response Center, the Office Product Group Security Team, and Google Threat Intelligence Group, per The Hacker News.
APT28’s weaponized RTF files use Shell.Explorer.1 ActiveX controls within RTF objects to retrieve next-stage payloads via HTTP and WebDAV without requiring macros. The lure documents use geopolitically charged narratives — references to transnational weapons smuggling, military training programs, and meteorological emergency bulletins — and are localized in Romanian, Slovak, Ukrainian, and English, according to Zscaler ThreatLabz researchers as cited by The Hacker News.
The attackers employ server-side geographic filtering, responding with the malicious DLL only when requests originate from the targeted geographic region and include the correct User-Agent HTTP header, per CSO Online. This evasion technique ensures that sandboxes and security researchers outside the target zone receive benign responses.
Two Parallel Attack Paths
Once the exploit fires, the infection branches into two distinct chains.
The first path deploys MiniDoor, a C++-based email stealer that is a variant of the previously documented NotDoor malware. MiniDoor weakens Microsoft Outlook’s security controls by modifying registry settings, monitors for MAPI logon events, and automatically forwards emails from the Inbox, RSS Feeds, Junk, and Drafts folders to attacker-controlled addresses. It marks forwarded messages to prevent duplication and deletes evidence from Sent folders, as CSO Online reported.
The second, more technically sophisticated path uses a previously undocumented dropper called PixyNetLoader. This tool deploys three encrypted payloads using a 0x47-byte XOR key, including a steganography-based shellcode loader named EhStoreShell.dll. The loader establishes persistence through COM hijacking, extracts shellcode hidden in PNG images using least-significant-bit encoding, and executes only when the host process is explorer.exe — a sandbox evasion check that ensures the malware runs on genuine workstations rather than analysis environments, according to Trellix’s research as cited by Bleeping Computer.
The final payload is a modified version of the open-source Covenant C2 framework, dubbed CovenantGrunt. It uses the legitimate cloud storage service filen.io for command-and-control communication, encrypting traffic with 2048-bit RSA key exchange and AES-256-GCM. By routing C2 traffic through a mainstream cloud platform, APT28 blends malicious communications with normal user activity, making network-level detection significantly harder, per Bleeping Computer.
Targeting and Scope
The campaign specifically targets military and government entities across Ukraine, Poland, Romania, Slovakia, Slovenia, Turkey, Greece, and the UAE. Trellix’s analysis breaks down the victim profile as defense ministries at 40 percent, transportation and logistics operators at 35 percent, and diplomatic entities at 25 percent. Zscaler identified over 60 compromised email addresses at Ukrainian central executive authorities alone, per The Hacker News.
The targeting pattern aligns with Russia’s strategic interest in Ukraine-related military logistics and NATO’s eastern flank. The focus on maritime and transport organizations, highlighted by CSO Online, reflects an intelligence collection priority on supply chains supporting Ukraine’s defense.
CISA added CVE-2026-21509 to its Known Exploited Vulnerabilities catalog and mandated that federal agencies patch affected systems by February 16, 2026.
Attribution
Multiple security firms and government agencies have attributed the campaign to APT28 with high confidence. The group — also tracked as Fancy Bear by CrowdStrike, Forest Blizzard by Microsoft, and Sednit by ESET — is assessed by the UK’s National Cyber Security Centre to be Russia’s GRU Military Intelligence Unit 26165. Attribution is based on code overlap with previously documented APT28 tools, including the BeardShell implant, consistent abuse of the filen.io platform for C2 infrastructure matching a September 2025 campaign tracked as Operation Phantom Net Voxel, and targeting patterns aligned with established Russian strategic priorities, according to The Hacker News.
The campaign is part of a broader escalation in APT28 activity. SecurityWeek’s 2026 threat landscape analysis noted that the most dangerous threat actors are those who integrate intelligence and technology into a single, continuous system, with the quickest APT campaigns now moving from initial access to data exfiltration in just 72 minutes, according to SecurityWeek.
What Remains Unclear
Neither Trellix nor Zscaler has disclosed specific victim organizations by name, the volume of data exfiltrated through the campaign, or whether any of the compromised entities detected the intrusions before researchers published their analyses. The campaign’s use of legitimate cloud infrastructure for C2 complicates post-incident forensics, as defenders must distinguish malicious filen.io traffic from routine file-sharing activity. Whether Microsoft’s January 26 patch fully mitigates the vulnerability or whether additional attack vectors exploiting the same OLE restriction bypass remain undiscovered has not been publicly addressed.