Russia-linked APT28 attackers already abusing new Microsoft Office zero-day

Russia-linked attackers are already exploiting Microsoft’s latest Office zero-day, with Ukraine’s national cyber defense team warning that the same bug is being used to target government agencies inside the country and organizations across the EU.

In an alert published on Sunday, CERT-UA says the activity is being driven by UAC-0001, better known as “APT28” or “Fancy Bear”, and hinges on CVE-2026-21509, a security feature bypass bug in Microsoft Office that Microsoft disclosed last week alongside a warning that attackers were already exploiting it in the wild.