Russian APT28 Targets Eastern European Governments with Exploited Office Vulnerability

Executive Summary

In early 2026, Russian state-sponsored cyber espionage group APT28, also known as Fancy Bear, has intensified its operations in Eastern Europe by exploiting the recently disclosed Microsoft Office vulnerability CVE-2026-21509. This activity underscores a significant escalation in cyber espionage targeting governmental institutions in the region.

Technical Details

APT28 has been observed weaponizing CVE-2026-21509, a critical vulnerability in Microsoft Office, to deliver malicious Rich Text Format (RTF) files. These files, when opened, execute code that installs malware capable of stealing email credentials and providing remote access to infected systems. The primary targets of this campaign have been government entities in Ukraine, Slovakia, and Romania. The exploitation of this zero-day vulnerability demonstrates APT28's rapid adaptation to newly disclosed security flaws, enhancing the group's ability to maintain persistent access to sensitive governmental networks. (cert.europa.eu)

Operational Impact

The exploitation of CVE-2026-21509 has enabled APT28 to establish long-term access to the networks of targeted Eastern European governments. This access facilitates the collection of sensitive information, including diplomatic communications and strategic plans, thereby compromising national security and diplomatic relations. The group's ability to swiftly weaponize new vulnerabilities indicates a high level of sophistication and resourcefulness, posing a significant threat to governmental cybersecurity infrastructures.

Recommendations

To mitigate the risks associated with this threat, it is imperative for Eastern European governmental organizations to:

• Implement Immediate Patches: Ensure that all systems are updated with the latest security patches, particularly those addressing CVE-2026-21509, to close the exploited vulnerability.

• Enhance Email Security Protocols: Deploy advanced email filtering solutions to detect and block malicious attachments and links, reducing the likelihood of successful phishing attempts.

• Conduct Regular Security Audits: Perform comprehensive security assessments to identify and remediate potential vulnerabilities within organizational networks.

• Strengthen Incident Response Plans: Develop and regularly update incident response strategies to ensure rapid detection, containment, and remediation of cyber intrusions.

Conclusion

The activities of APT28, particularly the exploitation of CVE-2026-21509, highlight the evolving and persistent nature of cyber espionage threats targeting Eastern European governments. Continuous vigilance, prompt patching, and robust cybersecurity practices are essential to defend against such sophisticated adversaries.

Highlights:

• CERT-EU - Cyber Brief 26-03 - February 2026, Published on Sunday, March 01