APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday

Akamai and Microsoft disclosed that CVE-2026-21513 (MSHTML security feature bypass, CVSS 8.8) was exploited as a zero-day in the wild; attackers (linked to APT28) used malicious LNK files embedding HTML to bypass Mark-of-the-Web and IE Enhanced Security Configuration, invoking ShellExecuteExW to execute local/remote resources outside the browser sandbox. Akamai identified a VirusTotal sample and infrastructure (wellnesscaremed.com) tied to the campaign, and Microsoft issued a patch in February 2026.