Russian hackers exploit recently patched Microsoft Office bug in attacks

CERT-UA reports that Russian-linked APT28 (Fancy Bear) has been actively exploiting a recently patched Microsoft Office zero-day (CVE-2026-21509) to deliver a loader and the COVENANT framework via malicious DOC files; the multi-stage chain uses WebDAV downloads, COM hijacking to load EhStoreShell.dll, shellcode hidden in an image, and a scheduled task (OneDriveHealth), with Filen used for command-and-control. Attacks targeted Ukrainian and EU government-related recipients; Microsoft issued an emergency patch and defenders are advised to apply updates, restart affected Office apps, follow registry mitigations if patching is delayed, and monitor or block Filen-related connections.