APT28 Leverages CVE-2026-21509 in Operation Neusploit

MITRE Techniques

• [T1566.001 ] Phishing: Spearphishing Attachment – Exploit RTFs were delivered as email attachments (‘Exploit RTFs were observed delivered as email attachments.’)
• [T1203 ] Exploitation for Client Execution – Vulnerability CVE-2026-21509 was exploited to initiate the infection chain (‘CVE-2026-21509 was exploited to initiate the infection chain.’)
• [T1106 ] Native API – Native APIs were used to execute the shellcode in Variant 2 (‘Native APIs were used to execute the shellcode for Variant 2.’)
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – A scheduled task (OneDriveHealth) was used to trigger the COM hijack and run the shellcode loader (‘A scheduled task was used for triggering the COM hijacking that runs the shellcode loader DLL.’)
• [T1204.002 ] User Execution: Malicious File – Users had to open/execute the exploit RTF to start the infection (‘Users must execute the exploit RTF to start the infection chain.’)
• [T1546.015 ] Event Triggered Execution: Component Object Model Hijacking – COM hijacking was used to load the malicious EhStorShell.dll into explorer.exe for persistence (‘COM hijacking is used for executing the Variant 2 shellcode loader DLL.’)
• [T1137.006 ] Office Application Startup: Add-ins – A malicious Outlook VBA project (MiniDoor) loads on Outlook startup to collect and exfiltrate email (‘A malicious Outlook VBA project is executed on Outlook startup.’)
• [T1140 ] Deobfuscate/Decode Files or Information – Shellcode and payloads are extracted/decoded from a PNG via steganography (‘Shellcode is encoded within PNG with steganography.’)
• [T1480.002 ] Execution Guardrails: Mutual Exclusion – Mutexes were used to prevent multiple instances and control execution (‘Mutexes are used to prevent multiple instances of the malware from executing at the same time.’)
• [T1027.007 ] Obfuscated Files or Information: Dynamic API Resolution – The Variant 2 shellcode loader resolves API names at runtime using DJB2 hashing (‘DJB2 hashing is used by the Variant 2 shellcode loader for API resolution.’)
• [T1027.003 ] Obfuscated Files or Information: Steganography – Covenant and its loader shellcode are encoded in the PNG using LSB steganography (‘Covenant and its loader shellcode is encoded in the PNG with LSB steganography.’)
• [T1497.003 ] Virtualization/Sandbox Evasion: Time Based Checks – The loader checks Sleep() timing to detect short-circuited sleeps used by sandboxes (‘The Variant 2 shellcode loader checks that Sleep API is not short-circuited as an anti-analysis/sandbox feature.’)
• [T1114 ] Email Collection – MiniDoor forwards mailbox items to actor-controlled email addresses to exfiltrate email (‘A malicious Outlook VBA project sends newly received emails to hardcoded email addresses controlled by the threat actor.’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – Covenant Grunt communicates over HTTPS for C2 traffic (‘Covenant Grunt uses HTTPS for C2 communication.’)
• [T1102.002 ] Web Service: Bidirectional Communication – The Filen API service is abused as a C2 bridge between Covenant Grunt and the actor’s server-side listener (‘The Filen API service is abused to bridge communications between Covenant Grunt implant and the actual Covenant C2 server-side listener.’)