APT28's Exploitation of Microsoft Office CVE-2026-21509 in 2026
In late January 2026, the Russian state-sponsored group APT28 exploited CVE-2026-21509, a zero-day vulnerability in Microsoft Office, to target Ukrainian and European Union organizations. The attackers distributed malicious DOC files themed around EU COREPER consultations and impersonated the Ukrainian Hydrometeorological Center, aiming to compromise over 60 government-related addresses. Upon opening these documents, a WebDAV-based download chain was initiated, leading to the installation of malware via COM hijacking, a malicious DLL (EhStoreShell.dll), shellcode concealed in an image file (SplashScreen.png), and a scheduled task (OneDriveHealth). This sequence culminated in the deployment of the COVENANT framework for command-and-control operations. The rapid weaponization of CVE-2026-21509 underscores the agility of nation-state actors in leveraging newly disclosed vulnerabilities. Organizations are urged to apply Microsoft's emergency out-of-band security updates released on January 26, 2026, to mitigate this actively exploited threat. ([rescana.com](https://www.rescana.com/post/microsoft-office-cve-2026-21509-zero-day-emergency-patch-released-to-counter-active-exploitation?utm_source=openai))
Kill Chain
