Three-Day Turnaround: How APT28 Rapidly Weaponized the Latest Microsoft Office Zero-Day

The sophisticated threat actor APT28 has commenced the exploitation of a nascent Microsoft Office vulnerability almost immediately following its public disclosure. According to researchers, these incursions were initiated within a mere three-day window, primarily targeting entities across Ukraine, Slovakia, and Romania.

Security analysts at Zscaler have designated this campaign Operation Neusploit, which centers upon CVE-2026-21509—a vulnerability bearing a CVSS score of 7.8. This flaw facilitates the subversion of Office’s defensive perimeters, allowing an adversary to execute malicious code upon the mere opening of a meticulously engineered document.

The vulnerability was identified and disclosed through a collaborative effort involving Microsoft’s Threat Intelligence and Security Response Centers, the Office Security team, and Google’s Threat Analysis Group. Researchers observed that the assailants utilized deceptive missives and documents in English, Romanian, Slovak, and Ukrainian. To maintain operational security, the adversarial infrastructure employed rigorous request filtering, disseminating malicious modules only when a solicitation originated from a targeted geographic region and presented matching browser telemetry.

The assault is initiated via a deleterious RTF document, which facilitates the deployment of one of two distinct loaders. The primary loader installs MiniDoor, a C++ based exfiltration module designed to harvest emails from the “Inbox,” “Spam,” and “Drafts” directories before transmitting them to predefined adversarial addresses. Analysts assess MiniDoor to be a streamlined iteration of the previously documented NotDoor utility.

The secondary loader, dubbed PixyNetLoader, orchestrates a significantly more intricate infection sequence. It establishes systemic persistence through COM object hijacking and extracts auxiliary components, including a code execution module and a PNG image. Concealed within this graphic is machine code embedded via steganography. The loader deciphers and executes this payload only after confirming it is not residing within an analytical environment and is being executed via the Windows Explorer process; otherwise, the malware remains dormant to elude detection.

Ultimately, the system is compromised by the Covenant remote administration framework, authored in .NET. This methodology mirrors tactics employed by APT28 in a 2025 campaign; however, while they previously relied on macros, they have now transitioned to utilizing DLL libraries, while retaining established methods for persistence, string encryption, and steganographic concealment.

Concurrently, CERT-UA has promulgated its own findings regarding these offensives. Their data indicates that the adversaries disseminated Word documents to over sixty addresses belonging to central executive authorities. One such decoy, authored on January 27, 2026, established a connection to an external server via the WebDAV protocol upon execution, subsequently retrieving a shortcut file to trigger the remaining infection chain. This sequence aligns perfectly with the PixyNetLoader architecture, culminating in the deployment of the Covenant management module.