APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaign
APT28 Operation Neusploit (TL-2026-0052), also tracked as Operation Neusploit, is a critical-severity advanced persistent threat campaign scored CVSS 7.8, first published 2026-02-03. It is attributed to APT28 (Russia) with high confidence, affects Microsoft Microsoft Office, references 1 CVE (CVE-2026-21509), maps to 57 MITRE ATT&CK techniques (T1003, T1005, T1018), and is covered by 14 detection rules and 47 indicators of compromise.
Key facts for TL-2026-0052
- Threat ID
- TL-2026-0052
- Also known as
- Operation Neusploit, UAC-0001
- Severity
- CRITICAL
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- APT
- First published
- 2026-02-03
- Last reviewed
- 2026-02-03
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- Government, Defense, Diplomatic, Military, Critical Infrastructure, Energy, Think Tanks, International Organizations
- Target regions
- NATO Countries, Ukraine, United States, European Union, United Kingdom, Germany, France, Poland, Baltics
- Detection rules
- 14
- Indicators of compromise
- 47
Malware and tooling in APT28 Operation Neusploit
Malware and tooling: Mimikatz
APT28 (Fancy Bear / Forest Blizzard / GRU Unit 26165) is conducting Operation Neusploit, a targeted espionage campaign weaponizing CVE-2026-21509 — the Microsoft Office OLE compound document security feature bypass (CVSS 7.8) — against government, defense, diplomatic, and critical infrastructure targets in NATO countries and Ukraine. The campaign delivers malicious Office documents via spearphishing that exploit the OLE vulnerability to bypass Protected View and execute embedded payloads without user interaction beyond opening the document. Post-exploitation leverages custom implants (CHOPSTICK/XAgent successor, HEADLACE loader, and a new modular backdoor codenamed NEUSPLOIT) for persistent access, credential harvesting, lateral movement, and data exfiltration targeting classified and sensitive diplomatic communications.
How APT28 Operation Neusploit works
Operation Neusploit — APT28/GRU CVE-2026-21509 Weaponized Espionage Campaign:
Threat Actor Profile — APT28:
APT28 (also tracked as Fancy Bear, Forest Blizzard, STRONTIUM, Pawn Storm, Sednit, Sofacy, Iron Twilight, Tsar Team, GruesomeLarch, FROZENLAKE, and Group 74) is a Russian state-sponsored cyber espionage unit attributed to the Russian Main Intelligence Directorate (GRU), specifically Unit 26165 of the 85th Main Special Service Center (GTsSS). Active since at least 2004, APT28 is one of the most prolific and technically sophisticated nation-state threat actors globally.
APT28 has conducted campaigns against: the Democratic National Committee (DNC, 2016), the World Anti-Doping Agency (WADA), the Organisation for the Prohibition of Chemical Weapons (OPCW), the German Bundestag, the French TV5Monde, Norwegian and Swedish military targets, Ukrainian government and military, NATO institutions, and countless government/defense organizations worldwide. In 2018, the DOJ indicted 12 GRU officers for the DNC hack.
Operation Neusploit — Kill Chain:
1. Reconnaissance (TA0043): - APT28 conducts extensive pre-compromise reconnaissance on target organizations - Harvests email addresses, organizational charts, and communication patterns of key personnel - Identifies MS Office versions in use via email header analysis and document metadata - Maps network architecture through OSINT of job postings, technical forums, and vendor relationships - Targets selected for strategic intelligence value: defense attachés, NATO planners, foreign ministry officials, energy sector executives
2. Weaponization (TA0042): - CVE-2026-21509 exploit integrated into OLE compound document structure - Malicious .docx files crafted with embedded OLE objects that bypass Protected View - Three delivery variants observed: a) Direct OLE exploit — malicious OLE object auto-executes on document open (bypasses Protected View) b) OLE-to-macro chain — OLE bypass disables Protected View, enabling embedded macro execution c) OLE-to-DDE chain — OLE bypass enables Dynamic Data Exchange (DDE) command execution - NEUSPLOIT implant: new modular backdoor written in C++ with encrypted C2 communication - Payload stages: Stage 0 (OLE exploit) → Stage 1 (HEADLACE loader DLL) → Stage 2 (NEUSPLOIT backdoor)
3. Delivery (TA0001): - Spearphishing emails crafted with high-quality social engineering - Lure themes: NATO exercise planning documents, defense procurement briefings, diplomatic cables, energy security assessments, Ukraine situation reports - Sender spoofing: compromised legitimate email accounts from allied organizations and think tanks - Delivery infrastructure: VPS providers (DigitalOcean, Hetzner), compromised Ubiquiti EdgeRouters, typosquatted domains mimicking NATO/government sites - Attached .docx files with convincing filenames: 'NATO_STEADFAST_DEFENDER_2026_BRIEF.docx', 'UA_SITREP_FEB2026_CLASSIFIED.docx', 'ENERGY_SECURITY_ASSESSMENT_Q1.docx'
4. Exploitation (TA0002): - User opens malicious .docx → CVE-2026-21509 OLE exploit triggers - Protected View bypassed — document opens in full editing mode without sandbox - OLE object executes embedded payload: PowerShell or cmd.exe command - Stage 1: HEADLACE loader DLL side-loaded via legitimate Microsoft signed binary (DLL search order hijacking) - HEADLACE establishes initial C2 beacon, downloads NEUSPLOIT from staging server - Execution chain: winword.exe → OLE exploit → cmd.exe/powershell.exe → rundll32.exe (HEADLACE) → NEUSPLOIT
5. Persistence (TA0003): - Registry Run Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run → legitimate-sounding entry - Logon Script: HKCU\Environment\UserInitMprLogonScript (documented APT28 technique) - Scheduled Task: schtasks.exe with legitimate task name ('Microsoft Office Telemetry') - Startup Folder: NEUSPLOIT shortcut in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup - COM Object Hijacking: replacing legitimate COM DLL with NEUSPLOIT loader
6. Command and Control (TA0011): - HTTPS C2 over port 443 — encrypted with custom certificate pinning - C2 domains: typosquatted NATO/government domains (e.g., nat0-int.org, defens3.gov.eu) - Fallback channels: IMAP/POP3 via compromised email servers, DNS tunneling, OneDrive/Google Drive API abuse - C2 rotation: new domain every 48-72 hours, registered via privacy-protecting registrars - Infrastructure: VPS providers (Hetzner, DigitalOcean, Linode), compromised Ubiquiti EdgeRouters, Tor exit nodes for operator access - NEUSPLOIT C2 protocol: HTTP POST with encrypted JSON payload, mimics legitimate Office telemetry traffic
7. Credential Access (TA0006): - Mimikatz variant: custom-compiled to evade signature detection - LSASS memory dumping via comsvcs.dll (MiniDump method) - NTLM hash extraction for pass-the-hash lateral movement - Kerberos ticket harvesting for Golden/Silver ticket attacks - Credential phishing: internal phishing from compromised accounts targeting high-value users - Wi-Fi credential harvesting via netsh commands (documented APT28 'Nearest Neighbor' technique)
8. Lateral Movement (TA0008): - Pass-the-Hash with harvested NTLM hashes - Remote service exploitation via SMB and WinRM - RDP with stolen credentials (often using PtH for RDP NLA bypass) - Exploitation of internal Active Directory: DCSync for domain admin credential extraction - Movement toward high-value targets: Exchange servers, file servers, classified network bridges
9. Data Exfiltration (TA0010): - Targeted collection: diplomatic cables, classified briefings, defense planning documents, intelligence assessments - Automated collection using PowerShell scripts targeting specific file types (.docx, .xlsx, .pptx, .pdf, .msg) - WinRAR archival with password protection before exfiltration - Exfiltration over C2 channel (HTTPS) in encrypted chunks - Alternative exfiltration: OneDrive/Google Drive API abuse, compromised email servers - Data staging: local staging directory before compression and exfiltration
NEUSPLOIT Implant Capabilities: - Modular plugin architecture (screenshot, keylogger, file browser, network scanner, credential harvester) - Anti-analysis: VM detection, sandbox evasion, debugger detection - Anti-forensics: timestomping, log deletion, MFT manipulation - Persistence: multiple redundant mechanisms (registry, scheduled task, COM hijacking) - Communication: HTTPS with certificate pinning, DNS tunneling fallback, email-based C2 backup - Self-update: downloads new modules from C2, updates configuration remotely - Exfiltration: encrypted file transfer, screenshot capture at configurable intervals
Relationship to TL-2026-0010 and TL-2026-0041: - TL-0010 documented CVE-2026-21509 as the Microsoft Office OLE vulnerability (attack surface analysis) - TL-0041 documented Russian GRU dual-track exploitation against Ukraine - TL-0052 documents APT28's SPECIFIC weaponized exploitation of CVE-2026-21509 for espionage (the operational campaign) - TL-0010 = the vulnerability, TL-0041 = the GRU strategic context, TL-0052 = the APT28 tactical operation
MITRE ATT&CK techniques used in TL-2026-0052
credential-access
T1003 OS Credential Dumping; T1040 Network Sniffing; T1110 Brute Force; T1555 Credentials from Password Stores; T1558 Steal or Forge Kerberos Tickets
collection
T1005 Data from Local System; T1039 Data from Network Shared Drive; T1056 Input Capture; T1113 Screen Capture; T1114 Email Collection; T1119 Automated Collection; T1560 Archive Collected Data
discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery
lateral-movement
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1134 Access Token Manipulation; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1550 Use Alternate Authentication Material
persistence
T1037 Boot or Logon Initialization Scripts; T1547 Boot or Logon Autostart Execution
exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution; T1204.002 Malicious File; T1559 Inter-Process Communication; T1569 System Services
command-and-control
T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
initial-access
T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Spearphishing Attachment
privilege-escalation
T1546 Event Triggered Execution
impact
stealth
resource-development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
reconnaissance
T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1595 Active Scanning; T1596 Search Open Technical Databases
Affected products and versions in APT28 Operation Neusploit
- Microsoft — Microsoft Office
Vulnerable versions: Unpatched versions
Fixed in: Patched versions (Jan 2026 update)
Remediation for APT28 Operation Neusploit
Patches
- Microsoft Office February 2026 Security Update — CVE-2026-21509 (OLE Compound Document Security Feature Bypass, CVSS 7.8)
Immediate actions
- Deploy February 2026 Microsoft Office security update for CVE-2026-21509 immediately across all endpoints — this is actively exploited by APT28
- Enable Attack Surface Reduction (ASR) rules: 'Block Office applications from creating child processes' and 'Block OLE object execution in Office applications'
- Block .docx attachments from external senders containing OLE objects at the email gateway (Exchange Online Protection, Proofpoint, Mimecast)
- Deploy IOC-based detections for known APT28 C2 domains, HEADLACE loader hashes, and NEUSPLOIT implant indicators
- Hunt for existing compromise: search for HEADLACE DLL (side-loaded via legitimate Microsoft binaries), NEUSPLOIT persistence mechanisms (registry keys, scheduled tasks), and anomalous winword.exe child processes
Workarounds
- Enable Protected View enforcement via Group Policy: force all documents from internet/email to open in Protected View without bypass
- Disable OLE object activation in Office via registry: HKCU\Software\Microsoft\Office\16.0\Word\Security\PackagerPrompt = 2 (block)
- Block outbound connections from winword.exe, excel.exe, powerpnt.exe via Windows Firewall rules
- Enable Office macro blocking for documents from the internet (already default in 2024+ but verify enforcement)
Longer-term hardening
- Implement application whitelisting (Windows Defender Application Control / AppLocker) to prevent unauthorized DLL loading
- Deploy EDR with behavioral detection for Office exploitation chains: winword.exe → cmd.exe/powershell.exe → rundll32.exe
- Implement network segmentation isolating workstations from sensitive servers, with micro-segmentation around classified networks
- Enable Microsoft Defender for Office 365 Safe Attachments with dynamic detonation for all inbound Office documents
- Conduct phishing resilience training focused on nation-state lure themes (NATO exercises, diplomatic cables, defense procurement)
- Implement DMARC/DKIM/SPF enforcement to detect sender spoofing from compromised allied organization accounts
CVEs associated with APT28 Operation Neusploit
Weaknesses (CWE) in APT28 Operation Neusploit
CWE-863
Timeline of APT28 Operation Neusploit
- APT28/Fancy Bear first observed active. Attributed to Russian GRU Unit 26165. Initial campaigns targeted military and government organizations in NATO countries and former Soviet states. Source: MITRE ATT&CK G0007
- FireEye publishes landmark report 'APT28: A Window into Russia's Cyber Espionage Operations' — first major public attribution linking APT28 to Russian military intelligence (GRU). Documented targeting of government, military, and media organizations. Source: https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
- CrowdStrike attributes Democratic National Committee (DNC) breach to APT28 (Fancy Bear) and APT29 (Cozy Bear). APT28 deployed X-Agent and X-Tunnel implants. Led to 2018 DOJ indictment of 12 GRU officers.
- U.S. Department of Justice indicts 12 Russian GRU officers from Unit 26165 and Unit 74455 for computer crimes related to the 2016 DNC hack. Named individuals and specific operational roles. Source: https://www.justice.gov/opa/page/file/1098481/download
- NSA, FBI, CISA joint advisory: Russian GRU (APT28) conducting global brute force campaign targeting cloud environments, government organizations, defense contractors, energy companies, logistics, think tanks. Kubernetes-based distributed password spraying. Source: https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
- Google TAG reports Ukraine remains Russia's primary cyber focus. APT28 among most active threat actors targeting Ukrainian government, military, and allied organizations. Credential phishing via typosquatted domains and compromised email accounts. Source: https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/
- Volexity discloses APT28 'Nearest Neighbor' attack: weaponized nearby Wi-Fi networks for covert access. Demonstrated novel proximity-based attack vector. Used password spraying, Wi-Fi credential harvesting, and PowerShell-based post-exploitation. Source: https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
- CVE-2026-21509 (Microsoft Office OLE compound document security feature bypass, CVSS 7.8) discovered. Allows bypassing Protected View when user opens specially crafted Office document. Exploitation requires user interaction (opening document) but no macro consent.
- APT28 integrates CVE-2026-21509 exploit into operational toolkit. Creates NEUSPLOIT implant — modular C++ backdoor delivered via HEADLACE loader. Three exploitation variants developed: direct OLE, OLE-to-macro chain, OLE-to-DDE chain.
- First observed Operation Neusploit spearphishing emails delivered to NATO defense planning staff. Lure documents themed as NATO STEADFAST DEFENDER 2026 exercise briefings. CVE-2026-21509 exploit triggers on document open, deploying HEADLACE loader.
- Campaign expands to diplomatic targets: foreign ministry officials in Germany, France, Poland, and Baltic states. Lure documents shift to diplomatic cable themes and EU energy security assessments. C2 infrastructure uses typosquatted government domains.
- Operation Neusploit targeting Ukrainian military command and intelligence personnel. Lure documents themed as Ukraine situation reports (SITREP) and defense procurement briefs. Exploitation delivers NEUSPLOIT with enhanced data collection modules targeting classified communications.
- Security researchers analyze NEUSPLOIT implant samples. Modular architecture with plugins: screenshot, keylogger, file browser, network scanner, credential harvester. Anti-analysis features: VM detection, sandbox evasion, debugger detection. C2: HTTPS with certificate pinning, DNS tunneling fallback.
- Microsoft releases February 2026 security update patching CVE-2026-21509. Patch modifies OLE compound document handling to enforce Protected View regardless of embedded object manipulation. APT28 exploitation window begins closing for patched systems.
- APT28 continues Operation Neusploit against unpatched targets. Government and defense organizations with slow patch deployment remain vulnerable. Exploitation shifts to focus on organizations with known patch lag (30-90 day windows). Critical infrastructure and military networks are priority targets.
- Threadlinqs Intelligence analysis: Operation Neusploit represents APT28's latest evolution — weaponizing CVE-2026-21509 for high-value espionage against NATO, Ukraine, and allied nations. The vulnerability is the entry point; the intelligence collection operation is the objective. Patch immediately. Hunt for HEADLACE and NEUSPLOIT indicators.
- As of 2026-05-29, CVE-2026-21509 has a Microsoft out-of-band patch (Jan 26) and sits in CISA KEV (Feb 16 deadline), so the entry vector is remediated — but APT28 kept exploiting unpatched targets post-patch and remains highly active (UK sanctions on GRU Unit 26165, router/DNS attacks, parallel "Prismex" campaign reusing this CVE). No source reports Operation Neusploit formally concluded, confirming residual risk for patch-lagging environments.
Sources cited for APT28 Operation Neusploit
- MITRE ATT&CK — APT28 (G0007) Threat Actor Profile
- NSA/FBI/CISA — Russian GRU Global Brute Force Campaign (APT28/Fancy Bear)
- DOJ — Indictment of 12 Russian GRU Officers for 2016 DNC Hack
- FireEye — APT28: A Window into Russia's Cyber Espionage Operations
- Volexity — The Nearest Neighbor Attack: APT28 Weaponized Wi-Fi Networks
- Google TAG — Ukraine Remains Russia's Biggest Cyber Focus in 2023
- Microsoft — STRONTIUM: Detecting New Patterns in Credential Harvesting
- Trend Micro — Pawn Storm: Lack of Sophistication as a Strategy
- Palo Alto Unit 42 — Sofacy Group's Parallel Attacks
- Trend Micro — Pawn Storm in 2019: Cyber Espionage Continues
- Microsoft — Cyberattacks Targeting U.S. Elections (STRONTIUM/APT28)
- Talos Intelligence — Cyber Conflict Decoy Document Analysis (APT28)
Threats related to APT28 Operation Neusploit
- APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage Campaign (CVE-2026-21509)
- Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting Ukrainian Defense Supply Chain
- APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)
- CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)
- APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing
- Operation MacroMaze: APT28 Campaign Targeting Western & Central Europe via Evolving Macro Droppers & Legitimate Infrastructure Abuse
Detection coverage for TL-2026-0052
As of 2026-02-03, Threadlinqs Intelligence publishes 14 detection rule(s) for TL-2026-0052 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.