Loading story…
An India-linked espionage campaign exploited CVE-2026-21509, a Microsoft Office security feature bypass in OLE object handling, to target Pakistani government entities, with Sindh Integrated Emergency & Health Services (SIEHS) identified as a primary victim. Breakglass Intelligence said the attackers used weaponized RTF, OLE, and DOCX files themed around ambulance surveillance procurement to deliver payloads with little or no user interaction beyond opening or previewing the document. The malicious files embedded Shell.Explorer.1 or WebBrowser ActiveX objects and abused an OLE ObjectPool stream containing a crafted Shell Link to retrieve LNK or ClickOnce payloads over WebDAV or HTTPS, bypassing Office OLE mitigations and avoiding macros.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The April report concluded the activity was distinct from previously reported Eastern Europe-focused exploitation and represented the first documented South Asian state-sponsored use of CVE-2026-21509. It also revealed test artifacts including an internal WebDAV server address and a mistyped payload path, indicating operational security mistakes.
Breakglass documented a separate cluster of exploit documents containing Chinese-language metadata, creator qb.li, and WPS Cloud identifiers. The finding suggested either a shared exploit builder across actors or separate adoption of the same technique by a Chinese-speaking operator.
A later Breakglass report described a wider state-sponsored espionage campaign exploiting CVE-2026-21509 against Pakistani government entities, with SIEHS identified as the primary victim. The report assessed the activity with medium-high confidence as India-linked and potentially associated with groups such as SideWinder, Confucius, or Patchwork.
Breakglass Intelligence reported developer metadata including MALDEV01, WarMachine, WPS Office artifacts, and English-India locale markers, assessing the sample was likely tied to a distinct South Asian APT or shared exploit builder rather than direct APT28 activity. The report also noted poor detections across antivirus and sandbox products.
The exploit chain delivered ClickOnce or LNK payloads from sbis.psca.gop.pk, a compromised Punjab Safe Cities Authority government subdomain with a valid TLS certificate. Breakglass reported this legitimate Pakistani government infrastructure gave the operation trust and reputation advantages.
A malicious Word 97-2003 document exploiting CVE-2026-21509 was created to target Sindh Integrated Emergency & Health Services procurement personnel in Pakistan using an ambulance surveillance procurement theme. The document used embedded OLE content to retrieve a malicious payload with little or no user interaction beyond opening or previewing the file.
A GitHub repository titled "Ashwesker-CVE-2026-21509" was published, indicating public release of code or proof-of-concept material related to CVE-2026-21509 shortly after Microsoft's disclosure. This represents a new technical development that could aid broader analysis or weaponization of the flaw.
Microsoft disclosed and patched CVE-2026-21509 on 2026-01-26, describing it as a Microsoft Office zero-day that was already being exploited in the wild via malicious Office documents. Reporting cited exploitation through the Shell.Explorer.1 COM/OLE object to invoke the legacy Internet Explorer engine and execute attacker-controlled LNK payloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourcegithub.com
Open sourcedecalage.info
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported **Pakistan-linked threat activity** targeting Indian government entities in campaigns dubbed **Gopher Strike** and **Sheet Attack**, assessed with *medium confidence* to potentially originate from a new subgroup or a parallel Pakistan-based actor rather than being definitively attributable to **APT36**. **Sheet Attack** uses legitimate services including **Google Sheets**, **Firebase**, and email for command-and-control (C2), while **Gopher Strike** begins with phishing emails delivering deceptive PDFs that display blurred content and a fake prompt to install an *Adobe Acrobat Reader DC* update. In **Gopher Strike**, clicking the “Download and Install” lure triggers delivery of an **ISO** payload only when server-side checks confirm the victim is in India and using a Windows user agent, a tactic intended to evade automated analysis. The ISO contains a Golang downloader, **GOGITTER**, which creates a VBScript (e.g., `windows_api.vbs`) in common directories (including `C:\Users\Public\Downloads`, `C:\Users\Public\Pictures`, and `%APPDATA%`) to poll for instructions and retrieve additional payloads, including **GITSHELLPAD**, which is described as leveraging **private GitHub repositories** (with embedded authentication tokens) for staging/persistence and follow-on access.
Jun 29, 2026
Ukraine’s CERT-UA reported active exploitation of a Microsoft Office zero-day, **CVE-2026-21509** (a security feature bypass), attributed to Russia-linked **UAC-0001 / APT28 (Fancy Bear)** and used to target Ukrainian government bodies and organizations across the EU. Microsoft disclosed the flaw with a warning that it was already being exploited in the wild, and CERT-UA observed rapid weaponization: a lure document titled `Consultation_Topics_Ukraine(Final).doc` appeared shortly after disclosure and was themed around EU discussions on Ukraine, suggesting the exploit chain was prepared in advance. CERT-UA also described a parallel phishing campaign impersonating the Ukrhydrometeorological Center, sent to 60+ recipients largely in Ukrainian central executive bodies. The attack chain described includes opening a malicious DOC that triggers a **WebDAV** connection to attacker infrastructure, downloads a shortcut (`.lnk`) used to stage additional payloads, and deploys components including a DLL masquerading as a legitimate Windows component (e.g., `EhStoreShell.dll`) with shellcode hidden in a decoy file (e.g., `SplashScreen.png`), alongside persistence techniques such as **COM hijacking** (registry modification) and scheduled task creation.
Jun 29, 2026
**Fancy Bear (APT28)** has been attributed with high confidence to *Operation Neusploit*, a campaign targeting users in Central and Eastern Europe by weaponizing **CVE-2026-21509**, a **Microsoft RTF** parsing zero-day that enables arbitrary code execution via specially crafted RTF documents. Reported lures were written in multiple languages (including English, Romanian, Slovak, and Ukrainian) and targeted victims in **Ukraine, Slovakia, and Romania**. Microsoft issued an **out-of-band patch** for CVE-2026-21509 on **January 26, 2026**, with in-the-wild exploitation observed shortly after. Post-exploitation activity was described as a multi-stage chain that retrieves a malicious dropper DLL from attacker infrastructure and then deploys different payload paths, including **MiniDoor** (focused on Outlook email theft/exfiltration) and **PixyNetLoader**, which ultimately leads to a **Covenant Grunt** implant for command-and-control. The campaign also uses **evasion and targeting controls**, including region-restricted payload delivery (e.g., only serving malicious DLLs to requests from targeted geographies and specific `User-Agent` patterns) and persistence techniques such as **COM hijacking**, plus additional tradecraft like **steganography in PNG files** and shellcode loading to execute the final implant.
Jun 29, 2026