APT28’s Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and Cloud C2 Infrastructure

APT28 is actively exploiting a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) in a multi-stage campaign targeting European defense and government entities, using convincing spear-phishing, advanced malware, and legitimate cloud storage for stealthy command-and-control and data exfiltration.