cyber.hendryadrian.com
Threat Research · zscaler.com

APT28 Used CVE-2026-21509 to Deploy Email-Stealing and Backdoor Malware in Eastern Europe

· Original article ↗

Summary

Zscaler researchers detail an APT28 campaign targeting Central and Eastern Europe with malicious RTF files exploiting CVE-2026-21509 to deliver MiniDoor email-stealing malware or a Covenant Grunt implant.

Key points

  • ThreatLabz attributed Operation Neusploit to APT28 with high confidence based on overlaps in tools, techniques, and procedures.
  • The campaign targeted users in Ukraine, Slovakia, and Romania with English and localized-language lures.
  • Malicious RTF files exploited CVE-2026-21509; Microsoft released an out-of-band update on January 26, 2026, and researchers observed exploitation on January 29.
  • One infection-chain variant installed MiniDoor, which enabled Outlook macros and forwarded emails from selected mailbox folders to attacker-controlled addresses.
  • A second variant used PixyNetLoader, COM hijacking, and a scheduled task to load shellcode concealed in a PNG file.
  • The second chain deployed a Covenant Grunt implant that used the Filen API as a command-and-control bridge.
  • Zscaler recommends installing Microsoft’s security updates for CVE-2026-21509.

Article Details

Attack Vectors
  • APT28 used specially crafted RTF files to exploit CVE-2026-21509 and download a malicious dropper DLL.
  • The campaign used English, Romanian, Slovak, and Ukrainian social-engineering lures.
  • The second infection chain used COM hijacking for persistence, a scheduled task, and shellcode hidden in a PNG file.
  • The MiniDoor Outlook macro collected mailbox messages and forwarded them to configured recipient addresses.
Defensive Notes
  • Install the latest Microsoft security updates to address CVE-2026-21509; Microsoft released an out-of-band update on January 26, 2026.
  • The article reports that Zscaler detects indicators related to the campaign through its cloud security platform.

Indicators of compromise

TypeIndicatorContext
DOMAINfreefoodaid[.]comMalicious domain hosting the MiniDoor dropper, PixyNetLoader, and an LNK file.
DOMAINwellnesscaremed[.]comDomain explicitly listed as malicious in the campaign's network indicators.
MD5154ff6774294e0e6a46581c8452a77deHash of the PNG file containing steganographically embedded shellcode.
MD52f7b4dca1c79e525aef8da537294a6c4Hash of an RTF file exploiting CVE-2026-21509.
MD54727582023cd8071a6f388ea3ba2feaaHash of an RTF file exploiting CVE-2026-21509.
MD57c396677848776f9824ebe408bbba943Hash of an RTF file exploiting CVE-2026-21509.
MD5859c4b85ed85e6cc4eadb1a037a61e16Hash of the Variant 2 PixyNetLoader dropper DLL.
MD595e59536455a089ced64f5af2539a449Hash of an RTF file exploiting CVE-2026-21509.
MD5d47261e52335b516a777da368208ee91Hash of an RTF file exploiting CVE-2026-21509.
MD5e4a5c4b205e1b80dc20d9a2fb4126d06Hash of the EhStoreShell.dll shellcode loader.
MD5ea6615942f2c23dba7810a6f7d69e2daHash of the Covenant Grunt implant using Filen API as a C2 bridge.
MD5ee0b44346db028a621d1dec99f429823Hash of the Windows scheduled task configuration file used in the infection chain.
MD5f05d0b13c633ad889334781cf4091d3eHash of MiniDoor.
MD5f3b869a8d5ad243e35963ba6d7f89855Hash of the Variant 1 dropper DLL for MiniDoor.
SHA122da6a104149cad87d5ec5da4c3153bebf68c411Hash of the PNG file containing steganographically embedded shellcode.
SHA123b6f9c00b9d5475212173ec3cbbcff34c4400a7Hash of the Covenant Grunt implant using Filen API as a C2 bridge.
SHA14592e6173a643699dc526778aa0a30330d16fe08Hash of an RTF file exploiting CVE-2026-21509.
SHA17bbb530eb77c6416f02813cd2764e49bd084465cHash of MiniDoor.
SHA1c1b272067491258ea4a2b1d2789d82d157aaf90aHash of the Variant 1 dropper DLL for MiniDoor.
SHA1c4799d17a4343bd353e0edb0a4de248b99295d4dHash of an RTF file exploiting CVE-2026-21509.
SHA1c8c84bf33c05fb3a69bc5e2d6377b73649b93dceHash of an RTF file exploiting CVE-2026-21509.
SHA1cea7e9323d79054f92634f4032c26d30c1cedd7eHash of the Windows scheduled task configuration file used in the infection chain.
SHA1d577c4a264fee27084ddf717441eb89f714972a5Hash of an RTF file exploiting CVE-2026-21509.
SHA1d788d85335e20bb1f173d4d0494629d36083dddcHash of an RTF file exploiting CVE-2026-21509.
SHA1da1c3e92f69e6ca0e4f4823525905cb6969a44adHash of the Variant 2 PixyNetLoader dropper DLL.
SHA1e52a9f004f4359ea0f8f9c6eb91731ed78e5c4d3Hash of the EhStoreShell.dll shellcode loader.
SHA2560bb0d54033767f081cae775e3cf9ede7ae6bea75f35fbfb748ccba9325e28e5eHash of the Variant 2 PixyNetLoader dropper DLL.
SHA2561ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f50Hash of an RTF file exploiting CVE-2026-21509.
SHA2562822c72a59b58c00fc088aa551cdeeb92ca10fd23e23745610ff207f53118db9Hash of the PNG file containing steganographically embedded shellcode.
SHA2563f446d316efe2514efd70c975d0c87e12357db9fca54a25834d60b28192c6a69Hash of the Covenant Grunt implant using Filen API as a C2 bridge.
SHA2565a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02Hash of an RTF file exploiting CVE-2026-21509.
SHA2569f4672c1374034ac4556264f0d4bf96ee242c0b5a9edaa4715b5e61fe8d55cc8Hash of the Windows scheduled task configuration file used in the infection chain.
SHA256a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1Hash of the EhStoreShell.dll shellcode loader.
SHA256a944a09783023a2c6c62d3601cbd5392a03d808a6a51728e07a3270861c2a8eeHash of the Variant 1 dropper DLL for MiniDoor.
SHA256b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546Hash of an RTF file exploiting CVE-2026-21509.
SHA256bb23545380fde9f48ad070f88fe0afd695da5fcae8c5274814858c5a681d8c4eHash of MiniDoor.
SHA256c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607fHash of an RTF file exploiting CVE-2026-21509.
SHA256fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436bHash of an RTF file exploiting CVE-2026-21509.
URLhxxps[:]//freefoodaid[.]com/documents/2_2[.]dURL hosting the MiniDoor dropper DLL.
URLhxxps[:]//freefoodaid[.]com/documents/2_2[.]lNkURL hosting an LNK file used in the campaign.
URLhxxps[:]//freefoodaid[.]com/tables/tables[.]dURL hosting PixyNetLoader.

MITRE ATT&CK

T1027.003 · SteganographyThe shellcode loader extracted shellcode concealed in the pixel data of SplashScreen.png using steganography.T1053.005 · Scheduled TaskPixyNetLoader registered the OneDriveHealth Windows scheduled task using schtasks.exe and office.xml.T1114.003 · Email Forwarding RuleThe MiniDoor Outlook macro forwarded mailbox messages to two hardcoded recipient addresses.T1203 · Exploitation for Client ExecutionCrafted RTF files exploited CVE-2026-21509 to start the infection chain.T1546.015 · Component Object Model HijackingPixyNetLoader set COM InProcServer32 registry values so the malicious DLL would load when explorer.exe started.

CVE

CVE-2026-21509region. In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in

Threat Actors

APT28The article attributes Operation Neusploit to APT28 with high confidence based on overlaps in tools, techniques, and procedures.

Malware

Covenant Gruntchain. We analyze the capabilities of the resulting tools, including MiniDoor, PixyNetLoader, and a Covenant Grunt implant, along with their command-and-control (C2) communications.MiniDoorpayload delivery, and the execution chain. We analyze the capabilities of the resulting tools, including MiniDoor, PixyNetLoader, and a Covenant Grunt implant, along with their command-and-control (C2) communications.NotDoorThreatLabz named this VBA-based malware MiniDoor, as it appears to be a minimal version of NotDoor reported by Lab52. Similar to NotDoor, MiniDoor collects emails from the infected machine, but does not support thePixyNetLoaderand the execution chain. We analyze the capabilities of the resulting tools, including MiniDoor, PixyNetLoader, and a Covenant Grunt implant, along with their command-and-control (C2) communications.

Vendors

Microsoftthe Central and Eastern European region. In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain.

Products

Microsoft Officeits TTPs by weaponizing the latest vulnerabilities in popular and widely used applications such as Microsoft Office.Microsoft OutlookThe first dropper variant DLL is responsible for deploying a malicious Microsoft Outlook Visual Basic for Applications (VBA) project named MiniDoor. MiniDoor’s primary goal is to steal the user’s emails and forward themMicrosoft WindowsSets the relevant Windows registry keys to downgrade Outlook security and allow the malicious project to load automatically each time Microsoft Outlook launches.

Tools

Covenantchain. We analyze the capabilities of the resulting tools, including MiniDoor, PixyNetLoader, and a Covenant Grunt implant, along with their command-and-control (C2) communications.

Countries

RomaniaIn January 2026, ThreatLabz identified APT28 weaponizing CVE-2026-21509 to target users in Central and Eastern Europe, including Ukraine, Slovakia, and Romania.SlovakiaIn January 2026, ThreatLabz identified APT28 weaponizing CVE-2026-21509 to target users in Central and Eastern Europe, including Ukraine, Slovakia, and Romania.UkraineIn January 2026, ThreatLabz identified APT28 weaponizing CVE-2026-21509 to target users in Central and Eastern Europe, including Ukraine, Slovakia, and Romania.

Related Articles