Russian APT28 Exploit Zero-Day Hours After Microsoft Discloses Office Vulnerability

CERT‑UA reports that APT28 rapidly weaponized a Microsoft Office zero‑day (CVE‑2026‑21509) within 24 hours of public disclosure to target Ukrainian government bodies and EU organizations with malicious DOC files that deploy the Covenant post‑exploitation framework via a WebDAV download, COM hijacking (EhStoreShell.dll), and a scheduled task named OneDriveHealth; the advisory includes IoCs, targeted email lures, and mitigation guidance (patching, registry protections, and blocking Filen.io C2 infrastructure).