CVE-2026-21509Active Exploitation(microsoft / 365_apps)

UAC-0001 (aka #APT28 or #FancyBear) exploits CVE-2026-21509 to target Ukraine and EU with COVENANT framework. Details (UA only): https://cert.gov.ua/article/6287250 https://t.co/oYPBtsn0cD

Someone submitted the real CVE-2026-21509 sample to EXPMON last night! Check out this submission: https://pub.expmon.com/analysis/311631/ The SHA256 of the sample, it's a RTF file: c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f While EXPMON didn't report the 0day immediately - this is well expected, it reported various highly suspicious Indicators, including the key Indicator named "activex compatibility shellexplorer registry key accessed". I shared how to use this key Indicator on EXPMON to hunt the 0day just days ago: https://x.com/HaifeiLi/status/2016340091505906035. That's enough to investigate it manually in your local env, and I have just confirmed this is indeed the CVE-2026-21509 zero-day exploit! My quick analysis showed that this is the initial attack vector sample in a full attacking chain. Thanks to EXPMON logs, I quickly found that the RTF file was trying to load the IE engine (the "ieframe.dll") while also trying to connect to the threat actor controlled server, one of the url is "\\wellnesscaremed[.]com\davwwwroot\venezia\Favorites\blank.doc" (see the pic attached) - all activities are automatic, meaning as soon as the victim open the Word document, the victim could be pwned. There're not just one but quite serveral OLE objects in the RTF which are, to be honest, quite sophisticated, showing the sophistication of the zero-day attack. Full details haven't been fully understood in such a short time. The same sample was also listed/confirmed by the Ukrainian CERT https://cert.gov.ua/article/6287250 independently, there're more details in that article please go check out. What a wild story! Thank you very much to the person who submitted the sample (and I received your message about adding the "unzip" feature:))! Once again it confirmed the effectiveness of the EXPMON system when it comes to detecting unknown 0day exploits. Quickly, for defenders: 1. Please research all the things starting from the sample, this is the confirmed CVE-2026-21509 0day intinal attack vector sample, and add detections (currently the detection ratio on VT is pretty low) in the full chain. 2. If you're an Microsoft Office user, please apply Microsoft's official patch or workarounds ASAP https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509, as now the attacking exploit is well known so attacks are expected to increase rapidly. For me, there's more work to do, including an EXPMON update for determinate detection against this 0day exploits. In the meantime, if you see the "activex compatibility shellexplorer registry key accessed" Indicator on EXPMON, please be cautions because that's likely the 0day sample/variants. #CVE-2026-21509 #expmon #0day #zeroday #exploit #threatintel

🔥𝗗𝗲𝗳𝗲𝗻𝗱𝗶𝗻𝗴 𝗔𝗴𝗮𝗶𝗻𝘀𝘁 𝗖𝗩𝗘‑𝟮𝟬𝟮𝟲‑𝟮𝟭𝟱𝟬𝟵: 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗢𝗳𝗳𝗶𝗰𝗲 𝗭𝗲𝗿𝗼‑𝗗𝗮𝘆 + 𝗞𝗤𝗟 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 CVE‑2026‑21509 is a high‑severity Microsoft Office zero‑day vulnerability actively exploited in the wild. Attackers can achieve arbitrary code execution through malicious documents embedding the legacy Shell.Explorer.1 OLE object, bypassing standard security prompts. The flaw affects Office 2016 through 365 (including LTSC builds), with emergency patches and registry mitigations now available. Defenders should prioritize applying updates or registry workarounds, while infrastructure teams patch corporate environments. To aid detection, the following KQL query highlights suspicious Office child processes spawned when opening documents weaponized with specially crafted OLE objects executing scripts.🫡 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 #Cybersecurity #MicrosoftOffice #ZeroDay #OLEVulnerability

Whoa! Who did this?? This seems to be the CVE-2026-21509 0day to me.. https://pub.expmon.com/analysis/311631/

Zscaler ThreatLabz has uncovered a new APT28 campaign that exploits CVE-2026-21509. Tracked as Operation Neusploit, this activity targets countries in Central and Eastern Europe, and uses weaponized Microsoft RTF files to deliver two new backdoors that we have named MiniDoor and PixyNetLoader. Read the full technical analysis here: https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit

Quick dance with CVE-2026-21509, a "Security Feature Bypass Vulnerability" and an emergency out-of-band fix from January Patch Tuesday (and an obligatory exaggerated YouTube thumbnail -- I apologize and appreciate folks who understand algorithm nuance) http://youtu.be/Ck8IPInn74A https://t.co/R9fcDphoqZ

‼️Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation Microsoft has issued an out-of-band emergency patch for a high-severity Microsoft Office zero-day, CVE-2026-21509 (CVSS 7.8), which is being actively exploited. The flaw is a security feature bypass that allows attackers to evade OLE protections by tricking users into opening a specially crafted Office file. The Preview Pane is not affected. Source: https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html

🔥𝗡𝗲𝘄 𝗔𝗣𝗧𝟮𝟴 𝗱𝗼𝗺𝗮𝗶𝗻 𝘂𝘀𝗲𝗱 𝗳𝗼𝗿 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟮𝟭𝟱𝟬𝟵 𝗰𝗮𝗺𝗽𝗮𝗶𝗴𝗻 Based on @anyrun_app sandbox submissions and intelligence lookup, I just found another new domain associated with APT28 used for CVE-2026-21509 attack campaign. The domain 48d83469-d0c6-4ade-8f82-e383fff094b8[.]webhook[.]site Let's Encrypt certificate was just created yesterday on the 7 Feb and hosted on a Hetzner Cloud Server residing in Germany. I am sharing the SHA256 of the word RTF document so that defenders can block or monitor this hash in their environment. 🫡 𝗔𝗣𝗧𝟮𝟴 𝗡𝗲𝘄 𝗗𝗼𝗺𝗮𝗶𝗻: 48d83469-d0c6-4ade-8f82-e383fff094b8[.]webhook[.]site 𝗪𝗼𝗿𝗱 𝗥𝗧𝗙 𝗦𝗛𝗔𝟮𝟱𝟲: 506e7512c897514e9d312a1532d2e2949ec8ebd73f6ca52740fb5e3306f08843 #Cybersecurity #Threathunting #APT28

How can we detect malicious documents exploiting the recent 0-day in MS Office CVE-2026-21509? I designed a YARA rule for this, which detects all the malicious files that have been reported. https://decalage.info/CVE-2026-21509/ https://t.co/IJLmINjWMZ

Russian state-sponsored threat group APT28 (aka Fancy Bear or UAC-0001) has launched a sophisticated espionage campaign targeting European military and government entities... Trellix https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/ @Trellix

APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign) https://blog.synapticsystems.de/apt28-geofencing-as-a-targeting-signal-cve-2026-21509/ https://t.co/K719kejTdk

Patch Diffing CVE-2026-21509 : Microsoft Office OLE Security Bypass https://blog.78researchlab.com/34cdb461-3e5b-808d-a9c9-dc1338adaccc

⚠️ APT28 is targeting Ukraine and allied supply chains using a confirmed zero-day (CVE-2026-21513) and PRISMEX malware. It also exploits CVE-2026-21509, with LNK delivery possibly chaining both flaws to enable theft and file-wiping. 🔗 Read here → https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html

UPDATE: APT28 began exploiting the Office 1-day CVE-2026-21509 within 24 hours of disclosure, per Trellix. Targets now include European military and transport orgs, with phishing lures delivering multi-stage loaders and custom implants via cloud-hosted C2. 🔗 Infection chain, sectors hit, evasion design → https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html#update

'previewme.doc' looks like some kind of RedTeam exercise by @buffaloverflow CVE-2026-21509 exploit. https://bazaar.abuse.ch/sample/f0d443055143cbd6bce8ef96b52d430e2db321b37b8b93a2a9d0354651702790/ https://t.co/w72jQ0OVsc

#APT28 + CVE-2026-21509 = Operation Neusploit https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit MiniDoor is a lightweight 64-bit DLL written in C++. The registry keys set by the MiniDoor DLL dropper to steal email from Microsoft Outlook. PixyNetLoader analysis The dropper DLL used in variant 2 of the attack chain is new and previously undocumented.

About the recent 0day vulnerability in MS Office (CVE-2026-21509): Samples or exploits have not been published yet, so it is not easy to develop detections. However we can try to guess how malicious documents might look like. (1/n)

🛡️ Russia-linked APT28 exploited a newly disclosed Microsoft Office flaw within days of disclosure. CVE-2026-21509 was used via malicious RTF files, with geo-fenced delivery targeting Ukraine, Slovakia, and Romania. 🔗 Read → https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html

GitHub - suuhm/CVE-2026-21509-handler: PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting Office 2016/2019/LTSC. https://github.com/suuhm/CVE-2026-21509-handler

CVE-2026-21509 Observation Based on the detailed writeup on "APT28 geofencing as a targeting signal cve-2026-21509" by Synaptics System. Link: https://blog.synapticsystems.de/apt28-geofencing-as-a-targeting-signal-cve-2026-21509/ It takes only about 4 days for APT28 to weaponize CVE-2026-21509 as the first sample of the file hash first appeared on Jan 30. The intriguing part is the exploit surface of CVE-2026-21509 only becomes visible after the OLE reconstruction step. The article demonstrate how APT28 abuse Microsoft Office OLE vulnerability which causes Office to make incorrect trust decisions during document parsing and making the decision to access a remote shortcut via WebDAV for further code execution. A high level KQL detection construct for defenders to monitor your Office applications reaching out for external WebDAV activity: DeviceNetworkEvents | where Timestamp > ago(1h) | where InitiatingProcessCommandLine has "file://" | where InitiatingProcessVersionInfoProductName == "Microsoft Office" | where RemoteIPType == "Public" Defenders should add this two domains to their tenant block list as a defense against CVE-2026-21509 exploits: wellnessmedcare[.]org freefoodaid[.]com #Cybersecurity #OLEVulnerability #MSOffice