Russian state-sponsored group APT28, also known as Fancy Bear, exploited CVE-2026-21509 in a fast-moving espionage campaign against European governments.
They targeted military, transport, and diplomatic entities in Poland, Slovenia, Turkey, Greece, the UAE, and Ukraine using spearphishing emails with malicious Office documents.
APT28 weaponized CVE-2026-21509 within 24 hours of its disclosure on January 26, 2026. This security feature bypass lets attackers run code via OLE objects without macros or warnings, using WebDAV to pull payloads from attacker servers.
Victims open RTF or DOC files like “BULLETEN_H.doc,” triggering a download of LNK shortcuts and SimpleLoader DLL.
The loader uses XOR encryption to drop files, including EhStoreShell.dll (BeardShell) and SplashScreen.png, hiding shellcode in PNG chunks.
BeardShell runs anti-sandbox checks, such as timing sleeps and process verification. It decodes the PNG with custom functions for headers, zlib inflation, and interlacing, then boots a fileless .NET loader via PEB walking.
A Covenant “Grunt” implant follows, using RSA/AES handshakes with filen.io cloud storage for C2. It polls folders, encrypts tasks with AES-256-GCM, and supports PowerShell or assembly execution all in memory to evade forensics.
In parallel, NotDoor targets Outlook. SimpleLoader turns off macro security in the registry and removes VbaProject.OTM to %APPDATA%\Microsoft\Outlook.
Macros trigger on login or new mail, forwarding the Inbox, Drafts, Junk, and RSS emails to attacker addresses before deleting traces.
Persistence uses COM hijacking of CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} in explorer.exe and a short-lived “OneDriveHealth” task. Post-exploitation runs systeminfo, arp, and injects into svchost.exe.
Phishing and Attribution
From January 28-30, 2026, APT28 sent 29 emails from compromised accounts in Romania, Bolivia, and Ukraine. Lures mimicked weapons-smuggling alerts (45%), military invitations (25%), NATO consultations (20%), and flood warnings, with bilingual decoys and seals.
.webp)
Domains like wellnessmedcare[.]org hosted payloads. CERT-UA attributes this to UAC-0001 (APT28, GRU-linked), noting code overlaps in the BeardShell PNG decoder and past TTPs such as cloud C2.
.webp)
Indicators Of Compromise
File Hashes (Selected):
Domains/IPs:
| Domain | IP Address |
|---|---|
| wellnesscaremed[.]com | 23.227.202[.]14 |
| wellnessmedcare[.]org | 193.187.148[.]169 |
| freefoodaid[.]com | 159.253.120[.]2 |
| longsauce[.]com | 72.62.185[.]31 |
MITRE ATT&CK Highlights:
- T1566.001: Spearphishing Attachment
- T1203: Exploitation for Client Execution (CVE-2026-21509)
- T1546.015: COM Hijacking
- T1102: Web Service (filen.io C2)
- T1114: Email Collection (NotDoor)
Patch Office immediately, enable macro blocks, and hunt for these IoCs. Tools like Trellix detect threats via signatures such as Malware.Binary.doc.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
.webp?fit=1600,900&ssl=1&description=Russian state-sponsored group APT28, also known as Fancy Bear, exploited CVE-2026-21509 in a fast-moving espionage campaign){kind=link}