Russian Hackers Exploit Fresh Office Flaw Hours After Patch
TL;DR
Within 48 hours of Microsoft issuing an urgent Office patch for CVE-2026-21509, the Russian-state group APT28 launched a fast, in-memory, fileless campaign that installed new backdoors (BeardShell and NotDoor) via staged spear-phishing across nine countries, targeting defense ministries, transportation operators, and diplomatic entities, with command-and-control hosted on legitimate cloud services to evade detection.
- Microsoft releases urgent Office patch. Russian-state hackers pounce. Ars Technica
- APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks The Hacker News
- Russian Hackers Weaponize Microsoft Office Bug in Just 3 Days Dark Reading
- Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation The Hacker News
- APT28 Exploits Microsoft Office Flaw to Target Ukraine and EU Governments Odessa Journal
Want the full story? Read the original reporting
Read on Ars Technica