Loading malware…
MiniDoor is a lightweight Microsoft Outlook-focused email-stealing implant associated with APT28 activity, particularly the Operation Neusploit espionage campaign exploiting CVE-2026-21509. It is commonly described as a stripped-down variant of NotDoor that removes broader backdoor functionality in favor of targeted mailbox collection and covert forwarding of victim email.
MiniDoor is deployed through a multi-stage infection chain initiated by weaponized Microsoft Office RTF or Word documents used in spearphishing campaigns. After exploitation, a dropper installs a malicious Outlook VBA project and modifies Outlook security settings so the project loads automatically and warning prompts are reduced or disabled. The malware monitors Outlook events such as user logon and new-mail activity, enumerates mailbox folders including common user folders, and forwards harvested messages to attacker-controlled mailboxes. It is designed to avoid obvious user visibility by suppressing artifacts such as retained sent-mail copies and by marking already processed messages to prevent duplicate forwarding.
The malware targets Windows systems running Microsoft Outlook and is intended for intelligence collection against government, military, and public-sector victims in Central and Eastern Europe, including Ukraine, Slovakia, and Romania. Its observed use, victimology, and tradecraft align with Russian state-sponsored espionage operations attributed with high confidence to APT28.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Spoločnosť Microsoft vydala mimoriadne bezpečnostné aktualizácie kancelárskeho balíka Microsoft Office, ktoré opravujú aktívne zneužívanú zero-day zraniteľnosť. CVE-2026-21509 možno zneužiť podvrhnutím špeciálne vytvorených súborov na obídenie bezpečnostných mechanizmov pre ochranu pred zneužitím niektorých funkcií COM/OLE a získanie úplnej kontroly nad systémom. | Cieľom je nainštalovať malvér MiniDoor (kradne e-maily) a PixyNetLoader, ktorý nainštaluje útočný nástroj Covenant.
CVE-2026-21513 zero-day: Exploited at least 11 days before the February 10, 2026 patch release... By combining zero-day exploitation (CVE-2026-21513) with rapid weaponization of newly disclosed vulnerabilities (CVE-2026-21509)... Immediate mitigations Patching: Prioritize the remediation of both CVE-2026-21509 and CVE-2026-21513 across the entire fleet immediately.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cieľom je nainštalovať malvér MiniDoor (kradne e-maily) a PixyNetLoader, ktorý nainštaluje útočný nástroj Covenant.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
The first dropper variant DLL is responsible for deploying a malicious Microsoft Outlook Visual Basic for Applications (VBA) project named MiniDoor.
Sets the relevant Windows registry keys to downgrade Outlook security and allow the malicious project to load automatically each time Microsoft Outlook launches.
“Strings decrypted using a hardcoded 1-byte XOR key… rolling XOR key…” and “Strings in this sample are XOR-encoded… and then Base64-encoded.”
"Deleting these messages from the ‘Sent’ folder so the victim never knows they were targeted."
The threat actor employed server-side evasion techniques, responding with the malicious DLL only when requests originated from the targeted geographic region and included the correct User-Agent HTTP header.
MiniDoor is a C++-based DLL file that steals a user's emails in various folders (Inbox, Junk, and Drafts) and forwards them to two hard-coded threat actor email addresses
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An implant/backdoor payload deployed via weaponized RTF lures in the referenced Operation Neusploit activity targeting Central and Eastern Europe.
Backdoor/email-stealing tool deployed via a dropper DLL; modifies registry keys to weaken Microsoft Outlook security and enables theft/exfiltration of emails, supporting long-term espionage access.
Lightweight 64-bit DLL that drops an encrypted Outlook VBA project, weakens Outlook macro security via registry changes, and automates email collection and exfiltration by forwarding messages to actor-controlled addresses while avoiding Sent-folder artifacts and duplicate forwarding.
Malware used to steal email data from infected systems as part of an APT28 spearphishing/exploit chain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.