Cybersecuritynews

Fancy Bear Exploits Microsoft Zero-Day Vulnerability CVE-2026-21509

First seen 10 Feb 2026, 16:42 UTC • Gbhackers

•83% similarity •34.1

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Russian cyber espionage group Fancy Bear, also known as APT28, has initiated Operation Neusploit, exploiting a zero-day vulnerability (CVE-2026-21509) in Microsoft RTF files. This vulnerability allows attackers to execute arbitrary code on victim systems, leading to the deployment of backdoors and email stealers, targeting various organizations.

ThreatCluster AI

Timeline

2026-01-26

CVE-2026-21509 published and added to CISA KEV

2026-01-27

First public PoC for CVE-2026-21509 released

2026-02-10

Fancy Bear launches Operation Neusploit exploiting CVE-2026-21509

Attack Flow

9 entities, 14 inferred relationships (STIX 2.1).

Threat Actor (2)

Apt28
Fancy Bear

Technique (4)

Data Breach
Malware
Zero-day Exploit
T1203 - Exploitation for Client Execution

Campaign (1)

Operation Neusploit

Organization (1)

Microsoft

Vulnerability (1)

CVE-2026-21509

Relationships

Apt28 uses Data Breach
Apt28 uses Malware
Apt28 uses Zero-day Exploit
Apt28 uses T1203 - Exploitation for Client Execution
Fancy Bear uses Data Breach
Fancy Bear uses Malware
Fancy Bear uses Zero-day Exploit
Fancy Bear uses T1203 - Exploitation for Client Execution
Apt28 exploits CVE-2026-21509
Fancy Bear exploits CVE-2026-21509
Operation Neusploit attributed to Apt28
Operation Neusploit attributed to Fancy Bear
Apt28 targets Microsoft
Fancy Bear targets Microsoft

Community

Browse all →

Fancy Bear Exploits Microsoft Zero-Day Vulnerability CVE-2026-21509

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading