Loading story…
Microsoft disclosed that the Russia-linked threat actor Storm-0978 used malicious Microsoft Word documents to exploit CVE-2023-36884, a remote code execution flaw in the Windows HTML component, in spear-phishing campaigns against government, defense, and other organizations in Europe and North America. The lures referenced Ukrainian political affairs and groups such as the Ukrainian World Congress, and the activity was tied to delivery of a backdoor with similarities to RomCom, alongside credential theft and follow-on intrusion activity.
Microsoft assessed the actor as pursuing both financially motivated ransomware and extortion operations and separate espionage-oriented campaigns, with links to RomCom distribution and ransomware families including Industrial Spy and Underground. The vulnerability affected multiple Windows, Windows Server, and Microsoft Office versions, and Microsoft issued security updates for CVE-2023-36884 while urging organizations to patch immediately, use Microsoft Defender protections, block child process creation from Office applications, and apply the registry-based mitigation FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION where patching or newer protections were not available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2023-07-17, NextronSystems released Sigma rules to detect techniques associated with RomCom and possible exploitation of CVE-2023-36884, including suspicious Office child-process spawning and related file, URL, and network behaviors. The rules expanded defender visibility into exploitation patterns tied to Storm-0978 activity.
Microsoft released security updates to address CVE-2023-36884 in its July Patch Tuesday updates. The fixes covered affected Windows and Office products, and Microsoft advised customers to install the updates and use available mitigations where patching was not possible.
Microsoft reported that Storm-0978 used malicious Microsoft Word documents in June 2023 to exploit CVE-2023-36884 before disclosure to Microsoft. The campaign targeted defense and government entities in Europe and North America with lures tied to Ukrainian political affairs and delivered a backdoor resembling RomCom.
On July 11, 2023, Microsoft published details linking Storm-0978 to both financially motivated ransomware/extortion activity and separate likely espionage-aligned credential theft and backdoor campaigns. The company also shared detection and mitigation guidance for defenders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcecert-mu.govmu.org
Open sourcefourcore.io
Open sourcemicrosoft.com
Open sourcemsrc.microsoft.com
Open sourceblogs.blackberry.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukraine’s CERT-UA reported active exploitation of a Microsoft Office zero-day, **CVE-2026-21509** (a security feature bypass), attributed to Russia-linked **UAC-0001 / APT28 (Fancy Bear)** and used to target Ukrainian government bodies and organizations across the EU. Microsoft disclosed the flaw with a warning that it was already being exploited in the wild, and CERT-UA observed rapid weaponization: a lure document titled `Consultation_Topics_Ukraine(Final).doc` appeared shortly after disclosure and was themed around EU discussions on Ukraine, suggesting the exploit chain was prepared in advance. CERT-UA also described a parallel phishing campaign impersonating the Ukrhydrometeorological Center, sent to 60+ recipients largely in Ukrainian central executive bodies. The attack chain described includes opening a malicious DOC that triggers a **WebDAV** connection to attacker infrastructure, downloads a shortcut (`.lnk`) used to stage additional payloads, and deploys components including a DLL masquerading as a legitimate Windows component (e.g., `EhStoreShell.dll`) with shellcode hidden in a decoy file (e.g., `SplashScreen.png`), alongside persistence techniques such as **COM hijacking** (registry modification) and scheduled task creation.
Jun 29, 2026
Microsoft documented **CVE-2021-40444** as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to **`T1566.001` Spearphishing Attachment**, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email. Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as **FormBook**. Splunk also published detection guidance for spotting Office processes loading **`mshtml.dll`**, noting that such module loads can indicate exploitation of **CVE-2021-40444** and may precede arbitrary code execution, data theft, or deeper compromise.
Aug 15, 2026
**APT28** (Russia-linked) has been observed exploiting a **Microsoft Office RTF zero-day, `CVE-2026-21509`**, in a campaign dubbed **Operation Neusploit** targeting organizations in **Central and Eastern Europe** (including **Ukraine, Slovakia, and Romania**). The intrusion chain begins with **socially engineered emails** delivering **weaponized RTF documents**; opening the file triggers code execution and downloads a malicious **dropper DLL** from attacker-controlled infrastructure, enabling follow-on payload deployment and persistence. Technical analysis describes **two dropper variants** that deploy different components, including **MiniDoor**, a malicious **Microsoft Outlook VBA** project designed to **steal and forward emails**. Observed behaviors include writing the VBA payload to `%appdata%\Microsoft\Outlook\VbaProject.OTM`, creating a mutex (`adjgfenkbe`), and modifying Windows Registry settings to **weaken Outlook security** so the malicious project loads automatically at Outlook startup; string decryption uses XOR routines (including a hardcoded `0x3a` key and a rolling XOR key). Reporting attributes the activity to APT28 based on TTP overlaps and notes exploitation was seen **in the wild** shortly after Microsoft issued an emergency fix.
Aug 14, 2026