As cited
Copy frozen at (site build).
threat intel
APT28 Leverages CVE-2026-21509 in Operation Neusploit
In January 2026, Zscaler ThreatLabz identified Russia-linked APT28 exploiting CVE-2026-21509 (CVSS 7.8) in a campaign targeting Central and Eastern Europe called Operation Neusploit. Attackers weaponized specially crafted Microsoft RTF files to deliver multiple-stage malware including MiniDoor (an Outlook email stealer), PixyNetLoader, and a Covenant Grunt implant, with active exploitation observed on January 29, 2026, days after Microsoft's January 26 patch release. The campaign employed geofencing, localized social engineering lures in Romanian, Slovak, and Ukrainian, and advanced evasion techniques including COM hijacking, steganography, and sandbox detection.
Why it matters: Organizations running Microsoft Office in Central and Eastern Europe face immediate risk from active exploitation of CVE-2026-21509; apply the January 26, 2026 Microsoft patch immediately and scrutinize RTF email attachments, especially those claiming to be consultation or curriculum documents.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
APT28 Leverages CVE-2026-21509 in Operation Neusploit
In January 2026, Zscaler ThreatLabz identified Russia-linked APT28 exploiting CVE-2026-21509 (CVSS 7.8) in a campaign targeting Central and Eastern Europe called Operation Neusploit. Attackers weaponized specially crafted Microsoft RTF files to deliver multiple-stage malware including MiniDoor (an Outlook email stealer), PixyNetLoader, and a Covenant Grunt implant, with active exploitation observed on January 29, 2026, days after Microsoft's January 26 patch release. The campaign employed geofencing, localized social engineering lures in Romanian, Slovak, and Ukrainian, and advanced evasion techniques including COM hijacking, steganography, and sandbox detection.
Why it matters: Organizations running Microsoft Office in Central and Eastern Europe face immediate risk from active exploitation of CVE-2026-21509; apply the January 26, 2026 Microsoft patch immediately and scrutinize RTF email attachments, especially those claiming to be consultation or curriculum documents.
- Source published
- First seen by Cybersecurity Tracker