Fancy Bear Exploits Microsoft Zero-Day Vulnerability CVE-2026-21509

Cybersecuritynews

Fancy Bear Exploits Microsoft Zero-Day Vulnerability CVE-2026-21509

First seen 10 Feb 2026, 16:42 UTC • •34.1

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

The Russian cyber espionage group Fancy Bear, also known as APT28, has initiated Operation Neusploit, exploiting a zero-day vulnerability (CVE-2026-21509) in Microsoft RTF files. This vulnerability allows attackers to execute arbitrary code on victim systems, leading to the deployment of backdoors and email stealers, targeting various organizations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 230d ago How this analysis works

Timeline

2026-01-26

CVE-2026-21509 published and added to CISA KEV

2026-01-27

First public PoC for CVE-2026-21509 released

2026-02-10

Fancy Bear launches Operation Neusploit exploiting CVE-2026-21509

More articles in this cluster (3)

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

APT28
Fancy Bear

Technique (4)

Data Breach
Malware
Zero-day Exploit
T1203 - Exploitation for Client Execution

Campaign (1)

Operation Neusploit

Organization (1)

Microsoft

Vulnerability (1)

CVE-2026-21509

Relationships

APT28 uses Data Breach
APT28 uses Malware
APT28 uses Zero-day Exploit
APT28 uses T1203 - Exploitation for Client Execution
Fancy Bear uses Data Breach
Fancy Bear uses Malware
Fancy Bear uses Zero-day Exploit
Fancy Bear uses T1203 - Exploitation for Client Execution
APT28 exploits CVE-2026-21509
Fancy Bear exploits CVE-2026-21509
Operation Neusploit attributed to APT28
Operation Neusploit attributed to Fancy Bear
APT28 targets Microsoft
Fancy Bear targets Microsoft

Following this threat?

Track APT28, Microsoft and CVE-2026-21509 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

APT28 Targets NATO Defense Firms with New Hookedge Backdoor The Russian espionage group APT28, also known as Swallowtail, has targeted defense contractors in two NATO countries, including a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. The attacks utilized a new backdoor called Hookedge, which was first documented in August 2026.…

Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that…