Russian state hackers exploit new Microsoft Office flaw in attacks on Ukraine, EU

Researchers and CERT-UA attribute active exploitation of Microsoft Office vulnerability CVE-2026-21509 to APT28 (Fancy Bear), where malicious Office documents delivered loaders and backdoors (PixyNetLoader, MiniDoor, Covenant) to targets in Ukraine, Slovakia, Romania and other European government entities; Microsoft has released a patch and the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.