Russia-linked APT28 attackers already abusing new Microsoft Office zero-day

CERT-UA reports that Russia-linked APT28 is actively exploiting a Microsoft Office zero-day (CVE-2026-21509) via malicious Word documents (e.g., "Consultation_Topics_Ukraine(Final).doc") to fetch payloads over WebDAV, drop a disguised DLL and image-embedded shellcode, achieve persistence through COM hijacking and a scheduled task, and deploy the COVENANT post-exploitation framework while routing traffic through cloud storage; multiple EU-targeted documents and rapidly registered infrastructure were observed and Microsoft has released patches though uptake may lag.