Russian Hackers Exploit New MS Office Flaw in Ukraine

Russian state-sponsored hackers, identified as APT28, have targeted Ukrainian government entities using a critical Microsoft Office vulnerability. This exploitation occurred mere days after Microsoft issued an emergency patch for CVE-2026-21509 on January 26, 2026. The vulnerability, which allows unauthorized attackers to bypass security features, had a severity score of 7.6/10 and was reportedly exploited in the wild as a zero-day.

Cybercriminals sent malicious DOC files to dozens of government-related addresses, with some lures referencing EU COREPER consultations and others impersonating Ukraine's Hydrometeorological Center. CERT-UA, Ukraine's Computer Emergency Response Team, identified the attack vector as malware loader previously used by APT28 in a June 2025 attack on Ukrainian government employees. The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-21509 to its catalog of known exploited vulnerabilities, urging immediate patching.