Fancy Bear Returns: APT28 Exploits Office Flaw in “Operation Neusploit”

Zscaler ThreatLabz reports that Russia-linked APT28 (Fancy Bear) launched "Operation Neusploit" targeting Ukraine, Slovakia, and Romania by weaponizing CVE-2026-21509 in Microsoft RTF files to deploy a multi-stage loader (PixyNetLoader) and a streamlined implant (MiniDoor) that steals email data; the campaign uses COM hijacking, DLL proxying, steganography (PNG-embedded shellcode), and Filen API-based C2, with exploitation observed days after Microsoft issued an out-of-band patch.