APT28 Exploits Active Microsoft Office Zero-Day to Deliver Malware
The advanced persistent threat group, APT28, has been identified exploiting a zero-day vulnerability in Microsoft Office. This vulnerability is used to deliver malware through a multi-stage attack campaign, primarily affecting users in Central and…
The advanced persistent threat group, APT28, has been identified exploiting a zero-day vulnerability in Microsoft Office. This vulnerability is used to deliver malware through a multi-stage attack campaign, primarily affecting users in Central and Eastern Europe, including Ukraine, Slovakia, and Romania.
This campaign, referred to as Operation Neusploit, involves weaponized RTF documents. The exploitation of CVE-2026-21509, a critical remote code execution vulnerability, begins when victims open these malicious RTF documents. After compromising the system, the malware downloads a dropper DLL from attacker-controlled infrastructure. Researchers identified two dropper variants, each deploying different payloads.
Dropper Variant 1: MiniDoor Deployment
The first variant deploys MiniDoor, a Microsoft Outlook Visual Basic for Applications project aimed at stealing emails. MiniDoor is a 64-bit DLL written in C++, using XOR encryption to decrypt embedded strings and the VBA project. It modifies Windows registry keys to lower Outlook security settings, enabling all macros and turning off content download warnings. MiniDoor then forwards emails to specific attacker-controlled addresses, suppressing detection by setting the DeleteAfterSubmit property.
The second variant uses PixyNetLoader, which decrypts payloads and drops three files: SplashScreen.png, EhStoreShell.dll, and office.xml. Persistence is achieved through COM object hijacking and a scheduled task named OneDriveHealth. This task initiates the loading of the malicious EhStoreShell.dll. The DLL uses anti-analysis techniques to avoid detection and employs steganography to extract shellcode from SplashScreen.png, executing it within memory.
The advanced persistent threat group, APT28, has been identified exploiting a zero-day vulnerability in Microsoft Office.
The final payload is a Covenant Grunt implant, part of the .NET Covenant command-and-control framework. This implant communicates with attacker infrastructure using the Filen API, leveraging legitimate cloud services to evade detection. The implant’s strings are obfuscated using XOR encoding.
Organizations should apply the Microsoft security update from January 26, 2026, to mitigate CVE-2026-21509. Caution is advised when opening RTF documents from unknown sources. Security teams should monitor for unauthorized registry modifications and investigate unintended VBA project deployments in Outlook directories. Network defenders should scrutinize outbound connections to Filen API and monitor for COM hijacking attempts targeting EhStoreShell.dll.
Consultation_Topics_Ukraine(Final).doc - RTF file exploiting CVE-2026-21509 Courses.doc - RTF file exploiting CVE-2026-21509 2_2.d - Dropper DLL for MiniDoor VbaProject.OTM - MiniDoor table.d - PixyNetLoader dropper DLL EhStoreShell.dll - Shellcode loader SplashScreen.png - PNG file with embedded shellcode office.xml - Scheduled task configuration file
Malicious domain: freefoodaid[.]com Malicious domain: wellnesscaremed[.]com URL for MiniDoor dropper DLL: hxxps://freefoodaid[.]com/documents/2_2.d URL for PixyNetLoader: hxxps://freefoodaid[.]com/tables/tables.d
Operation Neusploit demonstrates APT28's adaptation in exploiting vulnerabilities soon after their disclosure, maintaining persistence even after patches are available.
Based on reporting by GBHackers.