TA422

TA422 is a Russia-linked threat actor that overlaps with activity tracked by third parties as APT28 and Sofacy. The content describes TA422 conducting espionage-oriented phishing and exploitation campaigns primarily against Ukrainian and European government-related targets. Reported targeting includes Ukrainian government agencies and Ukrainian entities, as well as European defense, transportation, and diplomatic organizations and attacks against Ukraine and EU member states. The actor was reported to weaponize newly disclosed Microsoft vulnerabilities rapidly. Within 24 hours of public disclosure in January 2026, TA422 used malicious RTF files exploiting CVE-2026-21509, a Microsoft Office RTF/OLE remote code execution vulnerability. Proofpoint reported that this exploitation chain culminated in deployment of the NotDoor Outlook backdoor and Covenant Grunt implants, and that cloud storage services including filen.io were used as command-and-control infrastructure. TA422 was also reported to have exploited CVE-2026-32202 as a zero-day alongside CVE-2026-21513 in attacks beginning in late 2025 against Ukraine and EU member states. The content also attributes ClickFix-style social engineering activity to TA422 in October 2024. In that activity, TA422 sent phishing emails containing a link mimicking a Google spreadsheet, including lures purportedly sent by CERT-UA. The lure led victims through a reCAPTCHA-themed flow that presented a PowerShell command for execution. CERT-UA reported that the PowerShell created an SSH tunnel and ran Metasploit. Across the cited reporting, TA422’s tradecraft includes phishing, malicious document exploitation, rapid weaponization of public vulnerabilities, PowerShell-based execution, and use of post-exploitation tooling. Known aliases directly mentioned in the content are APT28 and Sofacy.