Zero-Day in Microsoft Office Enables Stealthy Malware Infections
On Mon, Jan 26, 2026, Microsoft announced a critical zero-day vulnerability in its Office suite, identified as CVE-2026-21509. This vulnerability is actively exploited, affecting government organizations and critical infrastructure through malicious…
On Mon, Jan 26, 2026, Microsoft announced a critical zero-day vulnerability in its Office suite, identified as CVE-2026-21509. This vulnerability is actively exploited, affecting government organizations and critical infrastructure through malicious document files.
CVE: CVE-2026-21509 Malicious Domains: freefoodaid[.]com, wellnesscaremed[.]com, wellnessmedcare[.]org C2 Infrastructure: .filen.net, .filen.io (146.0.41.204-208, 146.0.41.231-234) Malicious Files: BULLETEN_H.doc, Consultation_Topics_Ukraine(Final).doc Persistence Task: OneDriveHealth Threat Actor: UAC-0001 (APT28)
Security researchers identified the first malicious document on Thu, Jan 29, 2026, only three days post-disclosure. The document, "Consultation_Topics_Ukraine(Final).doc," falsely represented materials from the European Union COREPER committee regarding Ukraine consultations. It was created on Wed, Jan 27, 2026, at 07:43 UTC, which indicates rapid exploit development.
Simultaneously, a phishing campaign impersonating Ukraine's Hydrometeorological Center was launched. Targeted emails containing a weaponized DOC file named "BULLETEN_H.doc" were sent to over 60 recipients, mainly targeting Ukrainian government agencies.
Opening the malicious document in Microsoft Office triggers a WebDAV connection to external infrastructure, downloading a shortcut file with executable code.
On Mon, Jan 26, 2026, Microsoft announced a critical zero-day vulnerability in its Office suite, identified as CVE-2026-21509.
The payload comprises several components, including a DLL file, "EhStoreShell.dll," and an image file, "SplashScreen.png," containing shellcode. Registry modifications implement COM hijacking via CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}. The malware persists through a scheduled task named "OneDriveHealth" that restarts the explorer.exe process.
This activity executes shellcode from the image file, deploying the COVENANT post-exploitation framework. The attack infrastructure uses the Filen cloud storage service for command-and-control communications, complicating detection.
Further analysis in late January 2026 discovered additional exploit documents targeting European Union organizations. The tactics, techniques, and procedures suggest attribution to UAC-0001, also known as APT28, a Russian state-sponsored group. The rapid weaponization and targeting reflect coordinated espionage activities.
Microsoft advises immediate Windows registry configuration changes and application of security updates. Organizations should monitor or block network connections to the Filen infrastructure and enhance email filtering for Office documents.
Given the vulnerability's exploitation before widespread patch deployment, security teams should prioritize Microsoft Office updates and implement recommended mitigations to mitigate risks.
Based on reporting by GBHackers.