# Adobe Reader Zero-Day Actively Exploited via Malicious PDFs Targeting Russian Oil & Gas Sector

> An unpatched Adobe Reader zero-day is being actively exploited via weaponized PDFs containing obfuscated JavaScript that abuses privileged Acrobat APIs for code execution and data exfiltration. Sophos disclosed the campaign on 2026-04-07 with telemetry dating back to December 2025. Russian-language lures indicate targeted operations against the Russian oil and gas sector.

- **Published:** 2026-04-10T12:00:00Z
- **Last reviewed:** 2026-04-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0350
- **ID:** TL-2026-0350
- **Severity:** CRITICAL (CVSS 9)
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sophos X-Ops publicly disclosed on April 7, 2026 an active in-the-wild exploitation campaign leveraging a previously unknown vulnerability in Adobe Reader. The attack chain begins with social-engineering delivery of weaponized PDF documents carrying Russian-language lures themed around invoices and procurement documents associated with the Russian oil & gas sector. When opened in a vulnerable Adobe Reader build, the PDF executes heavily obfuscated JavaScript that invokes privileged Acrobat API methods normally restricted by the reader''s JavaScript sandbox. The privileged API abuse allows the attacker to drop and execute additional payloads, read local files, and initiate outbound command-and-control callbacks.

Sophos telemetry dates the earliest observed exploitation to December 2025, giving the campaign a four-month operational window before public disclosure and before Adobe shipped a patch. Analyzed samples include yummy_adobe_exploit_uwu.pdf (MD5 1929da3ef904efb8c940679045452321, SHA256 65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7) and Invoice540.pdf (MD5 522cda0c18b410daa033dc66c48eb75a). The embedded JavaScript layer stages decoded shellcode in memory, then calls out to hard-coded command-and-control endpoints. Observed C2 infrastructure includes the domain ado-read-parser[.]com and two raw-IP callback listeners on 169.40.2.68:45191 and 188.214.34.20:34123, with the stager identifying itself via the User-Agent string ''Adobe Synchronizer'' to masquerade as legitimate Adobe update traffic.

Sophos ships protection for the samples under Troj/PDF-BG and the network activity under Malware/Callhome, confirming real victims in production telemetry. As of disclosure there is no CVE assignment and no vendor patch — defenders should treat every inbound PDF with executable JavaScript as suspicious, disable Acrobat JavaScript where feasible, and block the published IOCs at the perimeter. The narrow victimology (Russian energy sector) and the sustained four-month operational window point to a capable, state-aligned or state-adjacent intrusion set rather than commodity crimeware.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Adobe Reader zero-day vulnerability in active exploitation](https://www.sophos.com/en-us/blog/adobe-reader-zero-day-vulnerability-in-active-exploitation)
- [Sophos X-Ops threat research](https://news.sophos.com/en-us/category/threat-research/)
- [Adobe Product Security Incident Response Team (PSIRT)](https://helpx.adobe.com/security.html)
- [Acrobat JavaScript API Reference](https://opensource.adobe.com/dc-acrobat-sdk-docs/acrobatsdk/html2/Acro12_MasterBook/JS_API_AcroJS.html)
- [MITRE ATT&CK T1203 Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203/)
- [MITRE ATT&CK T1566.001 Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0350