APT28’s Campaign Leveraging CVE‑2026‑21509 and Cloud C2 Infrastructure

APT28 rapidly weaponized a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) in a highly sophisticated, multi-stage espionage campaign targeting European government and military entities, leveraging fileless malware, cloud-based command-and-control, and convincing spear-phishing to evade detection and maintain persistent access.