APT28 Exploits Microsoft Office Zero-Day in Targeted Cyberattacks
A Russia-linked threat group, UAC-0001 (APT28), has been actively exploiting a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office to deploy malware against Ukrainian government entities and European Union organizations. The flaw was disclosed by Microsoft on January 26, 2026, with warnings of in-the-wild exploitation threat actors weaponized the vulnerability within 24 hours of public disclosure.
The rapid weaponization underscores the challenges defenders face against state-sponsored groups, as traditional prevention strategies struggle to keep pace. The attacks highlight the need for rapid patching, endpoint visibility, and containment measures to limit lateral movement and mitigate damage. No further details on the malware or specific targets have been released.
Source: https://www.linkedin.com/feed/update/urn:li:activity:7424354365555195904
European External Action Service cybersecurity rating report: https://www.rankiteo.com/company/european-external-action-service
"id": "EUR1770108815",
"linkid": "european-external-action-service",
"type": "Cyber Attack",
"date": "1/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Public Sector',
'location': 'Ukraine',
'name': 'Ukrainian government entities',
'type': 'Government'},
{'industry': 'Public Sector',
'location': 'Europe',
'name': 'European Union organizations',
'type': 'Government/International Organization'}],
'attack_vector': 'Microsoft Office vulnerability (CVE-2026-21509)',
'date_publicly_disclosed': '2026-01-26',
'description': 'A Russia-linked threat group, UAC-0001 (APT28), has been '
'actively exploiting a critical zero-day vulnerability '
'(CVE-2026-21509) in Microsoft Office to deploy malware '
'against Ukrainian government entities and European Union '
'organizations. The flaw was disclosed by Microsoft on January '
'26, 2026, with warnings of in-the-wild exploitation. Threat '
'actors weaponized the vulnerability within 24 hours of public '
'disclosure.',
'lessons_learned': 'The attacks highlight the need for rapid patching, '
'endpoint visibility, and containment measures to limit '
'lateral movement and mitigate damage.',
'motivation': 'State-sponsored cyber espionage',
'recommendations': 'Rapid patching, endpoint visibility, and containment '
'measures to limit lateral movement.',
'references': [{'source': 'Microsoft'}],
'threat_actor': 'UAC-0001 (APT28)',
'title': 'APT28 Exploits Microsoft Office Zero-Day in Targeted Cyberattacks',
'type': 'Zero-day exploitation',
'vulnerability_exploited': 'CVE-2026-21509'}