Fancy Bear Exploits Microsoft Zero-Day Vulnerability CVE-2026-21509

Cybersecuritynews

Fancy Bear Exploits Microsoft Zero-Day Vulnerability CVE-2026-21509

First seen 10 Feb 2026, 16:42 UTC • •34.1

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

The Russian cyber espionage group Fancy Bear, also known as APT28, has initiated Operation Neusploit, exploiting a zero-day vulnerability (CVE-2026-21509) in Microsoft RTF files. This vulnerability allows attackers to execute arbitrary code on victim systems, leading to the deployment of backdoors and email stealers, targeting various organizations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 183d ago How this analysis works

Timeline

2026-01-26

CVE-2026-21509 published and added to CISA KEV

2026-01-27

First public PoC for CVE-2026-21509 released

2026-02-10

Fancy Bear launches Operation Neusploit exploiting CVE-2026-21509

More articles in this cluster (3)

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Apt28
Fancy Bear

Technique (4)

Data Breach
Malware
Zero-day Exploit
T1203 - Exploitation for Client Execution

Campaign (1)

Operation Neusploit

Organization (1)

Microsoft

Vulnerability (1)

CVE-2026-21509

Relationships

Apt28 uses Data Breach
Apt28 uses Malware
Apt28 uses Zero-day Exploit
Apt28 uses T1203 - Exploitation for Client Execution
Fancy Bear uses Data Breach
Fancy Bear uses Malware
Fancy Bear uses Zero-day Exploit
Fancy Bear uses T1203 - Exploitation for Client Execution
Apt28 exploits CVE-2026-21509
Fancy Bear exploits CVE-2026-21509
Operation Neusploit attributed to Apt28
Operation Neusploit attributed to Fancy Bear
Apt28 targets Microsoft
Fancy Bear targets Microsoft

Following this threat?

Track Apt28, Microsoft and CVE-2026-21509 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Zimbra Exploited by Attackers A critical remote code execution vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite is being actively exploited by attackers. The flaw, which affects versions prior to 10.1.20, allows unauthenticated attackers to execute arbitrary commands as the Zimbra user through improper input sanitization in SNMP…

Russia's Hybrid Warfare Threatens UK with Cyberattacks and Sabotage Russia has escalated threats against the UK following its support for Ukraine, warning of 'consequences' for British involvement. Concurrently, Russian-linked cyberattacks, including a ransomware attack on the pathology lab Synnovis, have severely disrupted NHS services in London, affecting over 800 operations and 700…