# APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaign

> APT28 (Fancy Bear / Forest Blizzard / GRU Unit 26165) is conducting Operation Neusploit, a targeted espionage campaign weaponizing CVE-2026-21509 — the Microsoft Office OLE compound document security feature bypass (CVSS 7.8) — against government, defense, diplomatic, and critical infrastructure targets in NATO countries and Ukraine. The campaign delivers malicious Office documents via spearphishing that exploit the OLE vulnerability to bypass Protected View and execute embedded payloads without user interaction beyond opening the document. Post-exploitation leverages custom implants (CHOPSTICK/XAgent successor, HEADLACE loader, and a new modular backdoor codenamed NEUSPLOIT) for persistent access, credential harvesting, lateral movement, and data exfiltration targeting classified and sensitive diplomatic communications.

- **Published:** 2026-02-03T09:18:00Z
- **Last reviewed:** 2026-02-03T09:18:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0052
- **ID:** TL-2026-0052
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** APT
- **Status:** PATCHED
- **Actor:** APT28 (Russia)
- **Detections:** 14 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509

## Description

Operation Neusploit — APT28/GRU CVE-2026-21509 Weaponized Espionage Campaign:

Threat Actor Profile — APT28:

APT28 (also tracked as Fancy Bear, Forest Blizzard, STRONTIUM, Pawn Storm, Sednit, Sofacy, Iron Twilight, Tsar Team, GruesomeLarch, FROZENLAKE, and Group 74) is a Russian state-sponsored cyber espionage unit attributed to the Russian Main Intelligence Directorate (GRU), specifically Unit 26165 of the 85th Main Special Service Center (GTsSS). Active since at least 2004, APT28 is one of the most prolific and technically sophisticated nation-state threat actors globally.

APT28 has conducted campaigns against: the Democratic National Committee (DNC, 2016), the World Anti-Doping Agency (WADA), the Organisation for the Prohibition of Chemical Weapons (OPCW), the German Bundestag, the French TV5Monde, Norwegian and Swedish military targets, Ukrainian government and military, NATO institutions, and countless government/defense organizations worldwide. In 2018, the DOJ indicted 12 GRU officers for the DNC hack.

Operation Neusploit — Kill Chain:

1. Reconnaissance (TA0043):
- APT28 conducts extensive pre-compromise reconnaissance on target organizations
- Harvests email addresses, organizational charts, and communication patterns of key personnel
- Identifies MS Office versions in use via email header analysis and document metadata
- Maps network architecture through OSINT of job postings, technical forums, and vendor relationships
- Targets selected for strategic intelligence value: defense attachés, NATO planners, foreign ministry officials, energy sector executives

2. Weaponization (TA0042):
- CVE-2026-21509 exploit integrated into OLE compound document structure
- Malicious .docx files crafted with embedded OLE objects that bypass Protected View
- Three delivery variants observed:
  a) Direct OLE exploit — malicious OLE object auto-executes on document open (bypasses Protected View)
  b) OLE-to-macro chain — OLE bypass disables Protected View, enabling embedded macro execution
  c) OLE-to-DDE chain — OLE bypass enables Dynamic Data Exchange (DDE) command execution
- NEUSPLOIT implant: new modular backdoor written in C++ with encrypted C2 communication
- Payload stages: Stage 0 (OLE exploit) → Stage 1 (HEADLACE loader DLL) → Stage 2 (NEUSPLOIT backdoor)

3. Delivery (TA0001):
- Spearphishing emails crafted with high-quality social engineering
- Lure themes: NATO exercise planning documents, defense procurement briefings, diplomatic cables, energy security assessments, Ukraine situation reports
- Sender spoofing: compromised legitimate email accounts from allied organizations and think tanks
- Delivery infrastructure: VPS providers (DigitalOcean, Hetzner), compromised Ubiquiti EdgeRouters, typosquatted domains mimicking NATO/government sites
- Attached .docx files with convincing filenames: 'NATO_STEADFAST_DEFENDER_2026_BRIEF.docx', 'UA_SITREP_FEB2026_CLASSIFIED.docx', 'ENERGY_SECURITY_ASSESSMENT_Q1.docx'

4. Exploitation (TA0002):
- User opens malicious .docx → CVE-2026-21509 OLE exploit triggers
- Protected View bypassed — document opens in full editing mode without sandbox
- OLE object executes embedded payload: PowerShell or cmd.exe command
- Stage 1: HEADLACE loader DLL side-loaded via legitimate Microsoft signed binary (DLL search order hijacking)
- HEADLACE establishes initial C2 beacon, downloads NEUSPLOIT from staging server
- Execution chain: winword.exe → OLE exploit → cmd.exe/powershell.exe → rundll32.exe (HEADLACE) → NEUSPLOIT

5. Persistence (TA0003):
- Registry Run Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run → legitimate-sounding entry
- Logon Script: HKCU\Environment\UserInitMprLogonScript (documented APT28 technique)
- Scheduled Task: schtasks.exe with legitimate task name ('Microsoft Office Telemetry')
- Startup Folder: NEUSPLOIT shortcut in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
- COM Object Hijacking: replacing legitimate COM DLL with NEUSPLOIT loader

6. Command and Control (TA0011):
- HTTPS C2 over port 443 — encrypted with custom certificate pinning
- C2 domains: typosquatted NATO/government domains (e.g., nat0-int.org, defens3.gov.eu)
- Fallback channels: IMAP/POP3 via compromised email servers, DNS tunneling, OneDrive/Google Drive API abuse
- C2 rotation: new domain every 48-72 hours, registered via privacy-protecting registrars
- Infrastructure: VPS providers (Hetzner, DigitalOcean, Linode), compromised Ubiquiti EdgeRouters, Tor exit nodes for operator access
- NEUSPLOIT C2 protocol: HTTP POST with encrypted JSON payload, mimics legitimate Office telemetry traffic

7. Credential Access (TA0006):
- Mimikatz variant: custom-compiled to evade signature detection
- LSASS memory dumping via comsvcs.dll (MiniDump method)
- NTLM hash extraction for pass-the-hash lateral movement
- Kerberos ticket harvesting for Golden/Silver ticket attacks
- Credential phishing: internal phishing from compromised accounts targeting high-value users
- Wi-Fi credential harvesting via netsh commands (documented APT28 'Nearest Neighbor' technique)

8. Lateral Movement (TA0008):
- Pass-the-Hash with harvested NTLM hashes
- Remote service exploitation via SMB and WinRM
- RDP with stolen credentials (often using PtH for RDP NLA bypass)
- Exploitation of internal Active Directory: DCSync for domain admin credential extraction
- Movement toward high-value targets: Exchange servers, file servers, classified network bridges

9. Data Exfiltration (TA0010):
- Targeted collection: diplomatic cables, classified briefings, defense planning documents, intelligence assessments
- Automated collection using PowerShell scripts targeting specific file types (.docx, .xlsx, .pptx, .pdf, .msg)
- WinRAR archival with password protection before exfiltration
- Exfiltration over C2 channel (HTTPS) in encrypted chunks
- Alternative exfiltration: OneDrive/Google Drive API abuse, compromised email servers
- Data staging: local staging directory before compression and exfiltration

NEUSPLOIT Implant Capabilities:
- Modular plugin architecture (screenshot, keylogger, file browser, network scanner, credential harvester)
- Anti-analysis: VM detection, sandbox evasion, debugger detection
- Anti-forensics: timestomping, log deletion, MFT manipulation
- Persistence: multiple redundant mechanisms (registry, scheduled task, COM hijacking)
- Communication: HTTPS with certificate pinning, DNS tunneling fallback, email-based C2 backup
- Self-update: downloads new modules from C2, updates configuration remotely
- Exfiltration: encrypted file transfer, screenshot capture at configurable intervals

Relationship to TL-2026-0010 and TL-2026-0041:
- TL-0010 documented CVE-2026-21509 as the Microsoft Office OLE vulnerability (attack surface analysis)
- TL-0041 documented Russian GRU dual-track exploitation against Ukraine
- TL-0052 documents APT28's SPECIFIC weaponized exploitation of CVE-2026-21509 for espionage (the operational campaign)
- TL-0010 = the vulnerability, TL-0041 = the GRU strategic context, TL-0052 = the APT28 tactical operation

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1027 Obfuscated Files or Information
- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1586 Compromise Accounts
- T1587 Develop Capabilities
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1559 Inter-Process Communication
- T1547 Boot or Logon Autostart Execution
- T1037 Boot or Logon Initialization Scripts
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1134 Access Token Manipulation
- T1036 Masquerading
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1558 Steal or Forge Kerberos Tickets
- T1087 Account Discovery
- T1046 Network Service Discovery
- T1550 Use Alternate Authentication Material
- T1021 Remote Services
- T1560 Archive Collected Data
- T1119 Automated Collection
- T1005 Data from Local System
- T1113 Screen Capture
- T1056 Input Capture
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1071 Application Layer Protocol
- T1090 Proxy

## Sources

- [MITRE ATT&CK — APT28 (G0007) Threat Actor Profile](https://attack.mitre.org/groups/G0007/)
- [NSA/FBI/CISA — Russian GRU Global Brute Force Campaign (APT28/Fancy Bear)](https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF)
- [DOJ — Indictment of 12 Russian GRU Officers for 2016 DNC Hack](https://www.justice.gov/opa/page/file/1098481/download)
- [FireEye — APT28: A Window into Russia's Cyber Espionage Operations](https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf)
- [Volexity — The Nearest Neighbor Attack: APT28 Weaponized Wi-Fi Networks](https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/)
- [Google TAG — Ukraine Remains Russia's Biggest Cyber Focus in 2023](https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/)
- [Microsoft — STRONTIUM: Detecting New Patterns in Credential Harvesting](https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/)
- [Trend Micro — Pawn Storm: Lack of Sophistication as a Strategy](https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html)
- [Palo Alto Unit 42 — Sofacy Group's Parallel Attacks](https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/)
- [Trend Micro — Pawn Storm in 2019: Cyber Espionage Continues](https://documents.trendmicro.com/assets/white_papers/wp-pawn-storm-in-2019.pdf)
- [Microsoft — Cyberattacks Targeting U.S. Elections (STRONTIUM/APT28)](https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/)
- [Talos Intelligence — Cyber Conflict Decoy Document Analysis (APT28)](https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0052