APT28 Exploits Patched Microsoft Office Flaw in Ukraine

Russian-linked hackers known as APT28 have begun exploiting a recently patched vulnerability in Microsoft Office to target government and other organizations in Ukraine and Eastern Europe, cybersecurity researchers reported this week.

The attacks, observed starting January 29, 2026, three days after Microsoft released an emergency patch on January 26, involve phishing emails with malicious Rich Text Format and Word documents that weaponize CVE-2026-21509. This flaw, rated with a CVSS score of 7.8, allows attackers to bypass object linking and embedding mitigations in Microsoft Office and Microsoft 365 applications, enabling unauthorized code execution when users open the rigged files. Microsoft had identified the vulnerability as actively exploited in the wild before disclosure and urged immediate patching for affected versions, including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps.

Ukraine's Computer Emergency Response Team, or CERT-UA, detected one such document, named Consultation_Topics_UkraineFinal.doc, created on January 27 and containing text about European Union consultations on the situation in Ukraine. Another file, BULLETEN_H.doc, was distributed...