Loading story…
A South Korea-aligned espionage group tracked as APT-C-60 exploited a high-severity remote code execution flaw in WPS Office for Windows, CVE-2024-7262, to target users in East Asia. ESET said the attackers used a malicious MHTML spreadsheet containing a hidden hyperlink and a spreadsheet-like lure image to trick victims into interaction, after which WPS Spreadsheet automatically downloaded a remote library and executed arbitrary code. The observed final payload was a custom espionage backdoor dubbed SpyGlace, and separate reporting from DBAPPSecurity confirmed exploitation against users in China.
During its investigation, ESET found that Kingsoft’s initial fix did not fully resolve the issue and uncovered a second related arbitrary code execution vulnerability, CVE-2024-7263, tied to improper input validation. Both flaws were reported to Kingsoft through coordinated disclosure, and the vendor acknowledged and patched the vulnerabilities. The case highlights active in-the-wild exploitation of WPS Office as an espionage entry point, with attackers chaining document-based social engineering and remote library loading to compromise Windows systems.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Kingsoft acknowledged both high-severity WPS Office vulnerabilities and released patches for them. The issues were assigned CVE-2024-7262 and CVE-2024-7263.
During the coordinated disclosure process, DBAPPSecurity independently published an analysis of the weaponized vulnerability. It confirmed that APT-C-60 had exploited the flaw to deliver malware to users in China.
ESET disclosed CVE-2024-7262 and CVE-2024-7263 to Kingsoft through a coordinated disclosure process. The report covered both the original exploit path and the second path found during patch analysis.
After analyzing Kingsoft's initial patch, ESET discovered a second exploitation path caused by improper input validation and tracked it as CVE-2024-7263. This showed the original flaw had not been fully remediated.
Kingsoft issued an initial silent patch for the WPS Office vulnerability. ESET's later review found that this fix did not fully correct the underlying issue.
While investigating the APT-C-60 campaign, ESET Research identified the WPS Office for Windows arbitrary code execution flaw later tracked as CVE-2024-7262. Its analysis tied the exploit activity to the group through a suspicious spreadsheet referencing one of APT-C-60's downloader components.
ESET found that the South Korea-aligned espionage group APT-C-60 exploited the WPS Office for Windows remote code execution vulnerability CVE-2024-7262 in attacks targeting users in East Asia. The attack chain used a malicious MHTML spreadsheet and ultimately deployed the SpyGlace backdoor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceeset.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**APT28** (Russia-linked) has been observed exploiting a **Microsoft Office RTF zero-day, `CVE-2026-21509`**, in a campaign dubbed **Operation Neusploit** targeting organizations in **Central and Eastern Europe** (including **Ukraine, Slovakia, and Romania**). The intrusion chain begins with **socially engineered emails** delivering **weaponized RTF documents**; opening the file triggers code execution and downloads a malicious **dropper DLL** from attacker-controlled infrastructure, enabling follow-on payload deployment and persistence. Technical analysis describes **two dropper variants** that deploy different components, including **MiniDoor**, a malicious **Microsoft Outlook VBA** project designed to **steal and forward emails**. Observed behaviors include writing the VBA payload to `%appdata%\Microsoft\Outlook\VbaProject.OTM`, creating a mutex (`adjgfenkbe`), and modifying Windows Registry settings to **weaken Outlook security** so the malicious project loads automatically at Outlook startup; string decryption uses XOR routines (including a hardcoded `0x3a` key and a rolling XOR key). Reporting attributes the activity to APT28 based on TTP overlaps and notes exploitation was seen **in the wild** shortly after Microsoft issued an emergency fix.
Aug 21, 2026
An India-linked espionage campaign exploited **`CVE-2026-21509`**, a Microsoft Office security feature bypass in OLE object handling, to target Pakistani government entities, with Sindh Integrated Emergency & Health Services (**SIEHS**) identified as a primary victim. Breakglass Intelligence said the attackers used weaponized **RTF**, **OLE**, and **DOCX** files themed around ambulance surveillance procurement to deliver payloads with little or no user interaction beyond opening or previewing the document. The malicious files embedded **`Shell.Explorer.1`** or **WebBrowser ActiveX** objects and abused an OLE `ObjectPool` stream containing a crafted Shell Link to retrieve **LNK** or **ClickOnce** payloads over **WebDAV** or **HTTPS**, bypassing Office OLE mitigations and avoiding macros.
Jun 29, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026