When Documents Become the Attack Vector: Inside APT28’s Latest Microsoft Office Exploit

APT28 is actively exploiting a Microsoft Office zero-day delivered via specially crafted Office and RTF documents in targeted phishing emails; the exploit achieves unauthorized code execution without macros, allowing lightweight loaders to establish C2 while blending into normal Office activity. The report emphasizes detection blind spots when attackers abuse trusted processes and recommends behavior-focused detection and continuous breach validation (Seceon’s aiSIEM/aiXDR/aiBAS360) to correlate user, endpoint, and network signals and detect post-exploitation behavior.