Back Cybersecuritynews

Fancy Bear Hackers Exploiting Microsoft Zero

Cybersecuritynews •Tushar Subhra Dutta • February 10, 2026

The Russia-linked cyber espionage group known as Fancy Bear has launched Operation Neusploit. The group is also known as APT28. This marks a significant escalation, leveraging a zero-day vulnerability, CVE-2026-21509, in Microsoft RTF files. By exploiting this flaw, attackers execute arbitrary code on victim systems, deploying dangerous backdoors and email stealers. The campaign targets organizations […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fancy Bear Exploits Microsoft Zero-Day Vulnerability CVE-2026-21509 The Russian cyber espionage group Fancy Bear, also known as APT28, has initiated Operation Neusploit, exploiting a zero-day vulnerability (CVE-2026-21509) in Microsoft RTF files. This vulnerability allows attackers to execute arbitrary code on victim systems, leading to the deployment of backdoors and email stealers, targeting various organizations. 3 sources 34

Extracted Entities

Fancy Bear Hackers Exploiting Microsoft Zero

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

Campaigns (1)

Countries (1)

CVEs (1)

MITRE ATT&CK (1)