APT28 Exploits MSHTML Zero-Day Vulnerability in Windows

First seen 2 Mar 2026, 16:11 UTC • Gbhackers

•94.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

APT28 has actively exploited a zero-day vulnerability in MSHTML affecting all Windows versions, which has a CVSS score of 8.8. The vulnerability allows for security bypass and poses significant risks to users. A patch was released in February 2026 to address this issue.

How this analysis works

Timeline

2026-02-01

Patch released for MSHTML zero-day vulnerability

2026-03-02

APT28 exploits MSHTML zero-day vulnerability

Attack Flow

9 entities, 10 inferred relationships (STIX 2.1).

Threat Actor (1)

Apt28

Technique (4)

Data Breach
Malware
Zero-day Exploit
T1203 - Exploitation for Client Execution

Vulnerability (2)

CVE-2026-21513
Mshtml Zero-Day

Affected Platform (2)

Mshtml
Windows

Relationships

Apt28 uses Data Breach
Apt28 uses Malware
Apt28 uses Zero-day Exploit
Apt28 uses T1203 - Exploitation for Client Execution
Apt28 exploits CVE-2026-21513
Apt28 exploits Mshtml Zero-Day
CVE-2026-21513 targets Mshtml
CVE-2026-21513 targets Windows
Mshtml Zero-Day targets Mshtml
Mshtml Zero-Day targets Windows

Continue Reading

APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine GRU Compromises Home Routers in 23 States to Steal Outlook Credentials Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Critical RCE Vulnerability in Zimbra Exploited by Attackers Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials EU Sanctions Russia Over Ongoing Cyber Espionage Campaign

APT28 Exploits MSHTML Zero-Day Vulnerability in Windows

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading