{"id":113070,"date":"2026-02-02T18:46:17","date_gmt":"2026-02-02T18:46:17","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2026\/02\/02\/russia-linked-attackers-abuse-new-microsoft-office-zero-day-the-register\/"},"modified":"2026-02-02T18:47:19","modified_gmt":"2026-02-02T18:47:19","slug":"russia-linked-attackers-abuse-new-microsoft-office-zero-day-the-register","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2026\/02\/02\/russia-linked-attackers-abuse-new-microsoft-office-zero-day-the-register\/","title":{"rendered":"Russia-linked attackers abuse new Microsoft Office zero-day \u2022 The Register"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

Russia-linked attackers are already exploiting Microsoft’s newest Workplace zero-day, with Ukraine’s nationwide cyber protection group warning that the identical bug is getting used to focus on authorities companies contained in the nation and organizations throughout the EU.<\/p>\n

In an alert published on Sunday<\/a>, CERT-UA says the exercise is being pushed by UAC-0001, higher often called “APT28” or “Fancy Bear”, and hinges on CVE-2026-21509, a safety function bypass bug in Microsoft Workplace that Microsoft disclosed last week<\/a> alongside a warning that attackers had been already exploiting it within the wild.<\/p>\n

In accordance with CERT-UA, the primary weaponized doc surfaced simply days after Microsoft sounded the alarm concerning the flaw. A file titled “Consultation_Topics_Ukraine(Closing).doc” appeared publicly on January 29 and was themed round EU discussions on Ukraine. File metadata reveals it was created on January 27 \u2014 the day after Microsoft revealed particulars of the flaw \u2014 a turnaround time that implies the exploit chain was already ready and ready.<\/p>\n

\n