Russian hackers attacking European maritime and transport orgs using Microsoft Office exploit

Researchers report that APT28 (Fancy Bear) conducted a concentrated 72-hour spearphishing campaign exploiting Microsoft Office vulnerability CVE-2026-21509 to target government, maritime, transportation and diplomatic entities across Eastern Europe and beyond. Malicious Office documents deployed MiniDoor (email theft), PixyNetLoader, and ultimately a Covenant backdoor, using compromised government email accounts and legitimate cloud storage (Filen) for command-and-control to blend malicious traffic with normal activity.