APT28 Exploits Active Microsoft Office Zero-Day to Deliver Malware

The Russia-linked advanced persistent threat group APT28 has been observed actively exploiting a zero-day vulnerability in Microsoft Office to deliver malware through a sophisticated multi-stage attack campaign.

Security researchers from Zscaler ThreatLabz identified this new operation, dubbed Operation Neusploit, targeting users across Central and Eastern Europe with weaponized RTF documents.

The campaign specifically targeted Ukraine, Slovakia, and Romania using social engineering lures written in English, Romanian, Slovak, and Ukrainian to increase effectiveness.

Microsoft released an emergency out-of-band security update on January 26, 2026, but researchers observed active exploitation continuing on January 29, 2026, indicating threat actors maintained access even after patch availability.

In January 2026, ThreatLabz detected APT28 leveraging specially crafted Microsoft RTF files to exploit CVE-2026-21509, a critical remote code execution vulnerability.

The attack chain begins when victims open malicious RTF documents, triggering CVE-2026-21509 exploitation.

Upon successful compromise, the malware downloads a dropper DLL from attacker infrastructure. ThreatLabz identified two distinct dropper variants deploying different payloads, demonstrating the campaign’s versatility.

MiniDoor Email Stealer Deployed

The first dropper variant deploys MiniDoor, a malicious Microsoft Outlook Visual Basic for Applications project designed to steal emails.

MiniDoor is a lightweight 64-bit DLL written in C++ that implements malicious functionality through the exported function UIClassRegister.

The dropper uses XOR encryption to decrypt embedded strings and the VBA project stored in its .rdata section.

After decryption, the dropper writes MiniDoor to %appdata%MicrosoftOutlookVbaProject.OTM and modifies Windows registry keys to downgrade Outlook security settings.

These registry modifications enable all macros in Outlook, turn off content download warnings, and ensure the malicious macro provider loads automatically.

ThreatLabz analysis reveals MiniDoor functions as a simplified version of NotDoor, previously attributed to APT28 by Lab52 researchers in September 2025.

MiniDoor monitors the MAPILogonComplete event and systematically searches Inbox, RssFeeds, Junk, and Drafts folders for existing emails.

The malware forwards discovered messages to two hardcoded attacker-controlled email addresses: [email protected] and [email protected].

To maintain stealth, MiniDoor sets the DeleteAfterSubmit property to prevent copies from appearing in the Sent folder.

The second dropper variant implements a more complex infection chain through PixyNetLoader, a previously undocumented tool that establishes persistence and deploys additional components.

PixyNetLoader decrypts embedded payloads using a 71-byte rolling XOR key and drops three files: SplashScreen.png, EhStoreShell.dll, and office.xml.

The malware achieves persistence through COM object hijacking by modifying registry keys associated with the legitimate Enhanced Storage Shell Extension DLL.

PixyNetLoader creates a Windows scheduled task named OneDriveHealth that executes one minute after registration.

This task terminates and restarts explorer.exe, triggering the malicious EhStoreShell.dll to load through the hijacked COM interface.

The DLL implements anti-analysis techniques including host process verification and sleep timing checks to detect sandbox environments.

If these checks pass, EhStoreShell.dll extracts shellcode hidden within SplashScreen.png using steganography techniques.

The steganography implementation stores encoded data in the least significant bits of PNG pixel bytes.

After extraction, EhStoreShell.dll allocates executable memory, copies the shellcode, and transfers execution control. The shellcode employs CLR hosting techniques to load an embedded .NET assembly directly into memory.

Covenant Grunt Implant

The final payload is a Covenant Grunt implant, part of the open-source .NET Covenant command-and-control framework.

This implant uses the Filen API as a C2Bridge to communicate with attacker infrastructure, abusing legitimate cloud storage services to evade network detection.

Strings within the sample are obfuscated using XOR encoding with the key EIZ4EG2K8R followed by Base64 encoding.

ThreatLabz attributes Operation Neusploit to APT28 with high confidence based on multiple factors. The victimology aligns with APT28’s historical targeting of Central and Eastern European countries.

MiniDoor represents a stripped-down variant of NotDoor, previously linked to APT28. The abuse of Filen API for C2 communications matches tactics documented in Operation Phantom Net Voxel, another APT28 campaign reported by Sekoia in September 2025.

The threat actors implemented sophisticated server-side evasion to limit exposure. Attacker-controlled servers deliver malicious DLL payloads only when requests originate from targeted geographic regions and include correct User-Agent HTTP headers.

This geographic filtering prevents researchers outside target regions from easily obtaining samples.

Organizations should immediately apply the Microsoft security update released on January 26, 2026, to address CVE-2026-21509.

Users should exercise caution when opening RTF documents from unknown sources. Security teams should monitor for registry modifications related to Outlook security settings and investigate any unauthorized VBA projects in Microsoft Outlook directories.

Network defenders should scrutinize outbound connections to Filen API infrastructure and monitor for COM hijacking attempts targeting EhStoreShell.dll.

The campaign demonstrates APT28’s continued evolution in tactics, techniques, and procedures by weaponizing CVE-2026-21509 shortly after disclosure and maintaining exploitation even after patch availability.

ThreatLabz continues monitoring Operation Neusploit and collaborating with Microsoft to track this evolving threat.

IOCs

File indicators

Network indicators

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.