# APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing

> APT28 (Fancy Bear / UAC-0001 / Forest Blizzard) exploits CVE-2026-21509, a Microsoft Office security feature bypass (CVSS 7.8, CWE-807), in targeted spear-phishing campaigns against Ukraine and EU member states. Weaponized DOC files themed around EU COREPER consultations on Ukraine bypass Office security protections. CISA added CVE-2026-21509 to KEV on January 26, 2026 with a February 16 remediation deadline. Patched in January 2026 Patch Tuesday.

- **Published:** 2026-02-23T12:00:00Z
- **Last reviewed:** 2026-02-23T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0133
- **ID:** TL-2026-0133
- **Severity:** HIGH (CVSS 7.8)
- **Category:** APT
- **Status:** PATCHED
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509, CVE-2017-0199

## Description

CERT-UA (alert #19542) identified APT28 (tracked as UAC-0001 in Ukrainian taxonomy) actively exploiting CVE-2026-21509 against Ukrainian government entities and EU member state institutions in February 2026. The campaign uses weaponized Microsoft Word documents themed around EU Council COREPER (Committee of Permanent Representatives) consultations regarding Ukraine policy.

## CVE-2026-21509 Technical Details

CVE-2026-21509 is a Microsoft Office security feature bypass caused by reliance on untrusted inputs in a security decision (CWE-807). The vulnerability has:
- CVSS 3.1 Base Score: 7.8 (HIGH)
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Local (requires user to open malicious document)
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required (victim must open the weaponized DOC)
- Impact: High confidentiality, integrity, and availability impact

The vulnerability allows an unauthorized attacker to bypass Microsoft Office security features locally. When a user opens a specially crafted document, Office fails to properly validate security-relevant inputs, allowing the attacker to bypass protections such as Protected View, macro security warnings, or Mark of the Web (MOTW) checks that would normally prevent malicious code execution.

## Affected Products

All major Microsoft Office versions are vulnerable:
- Microsoft 365 Apps for Enterprise (x64 and x86)
- Microsoft Office 2016 (x64 and x86)
- Microsoft Office 2019 (x64 and x86)
- Microsoft Office LTSC 2021 (x64 and x86)
- Microsoft Office LTSC 2024 (x64 and x86)

## APT28 Campaign Details

APT28 (also known as Fancy Bear, Sofacy, Sednit, Forest Blizzard, Pawn Storm, and STRONTIUM) is Unit 26165 of Russia's GRU (Main Intelligence Directorate). The group has conducted cyber operations since at least 2004, targeting government, military, security organizations, and critical infrastructure worldwide.

### Campaign Characteristics:
- **Lure theme**: EU COREPER consultations on Ukraine — highly targeted geopolitical content designed to appear legitimate to EU and Ukrainian government officials
- **Delivery**: Spear-phishing emails with weaponized DOC attachments
- **Exploit**: CVE-2026-21509 bypasses Office security features, enabling payload execution without standard security warnings
- **Targets**: Ukrainian government entities, EU member state diplomatic missions, EU Council staff
- **Attribution**: CERT-UA attributes to UAC-0001 (APT28) based on TTPs, infrastructure, and targeting patterns consistent with GRU operations

### Historical Context:
APT28 has a documented pattern of exploiting Microsoft Office vulnerabilities in campaigns against Ukraine and European targets:
- CVE-2023-23397 (Outlook privilege escalation) — used against Ukrainian and European organizations
- CVE-2023-38831 (WinRAR) — weaponized against Ukraine military
- CVE-2017-0199 (Office/WordPad RCE) — extensive use in APT28 campaigns
- Repeated targeting of EU diplomatic communications, NATO, and OSCE

## CISA KEV Details

- Added to KEV: January 26, 2026
- Remediation deadline: February 16, 2026 (BOD 22-01)
- Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use
- Known ransomware use: Not confirmed

## Patch Information

Microsoft patched CVE-2026-21509 in the January 14, 2026 Patch Tuesday release. Organizations that have not applied the January 2026 cumulative update remain vulnerable. The CISA KEV deadline of February 16 has already passed — any unpatched systems are in violation of BOD 22-01 requirements.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1190 Exploit Public-Facing Application
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1553.005 Mark-of-the-Web Bypass
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1221 Template Injection
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1068 Exploitation for Privilege Escalation
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1087.002 Domain Account
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1114.001 Local Email Collection
- T1560.001 Archive via Utility
- T1003.001 LSASS Memory
- T1056.001 Keylogging
- T1021.002 SMB/Windows Admin Shares
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1573.002 Asymmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1588.005 Exploits
- T1608.001 Upload Malware
- T1587.004 Exploits

## Sources

- [CERT-UA #19542: APT28 Exploits CVE-2026-21509 Against Ukraine and EU](https://cert.gov.ua/article/6287250)
- [NVD: CVE-2026-21509 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-21509)
- [Microsoft Security Update Guide: CVE-2026-21509](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509)
- [CISA KEV: CVE-2026-21509](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509)
- [Vicarius: CVE-2026-21509 Detection Script](https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability)
- [Vicarius: CVE-2026-21509 Mitigation Script](https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability)
- [MITRE ATT&CK: APT28 Group Profile](https://attack.mitre.org/groups/G0007/)
- [Microsoft: Forest Blizzard (APT28) Threat Intelligence](https://www.microsoft.com/en-us/security/blog/tag/forest-blizzard/)
- [CISA: Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a)
- [BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/binding-operational-directive-22-01)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0133