{
  "name": "Leveraging of CVE-2026-21509 in Operation Neusploit",
  "slug": "leveraging-of-cve-2026-21509-in-operation-neusploit",
  "description": "A new campaign dubbed Operation Neusploit, attributed to the Russia-linked APT28 group, targets Central and Eastern European countries using specially crafted Microsoft RTF files to exploit CVE-2026-21509. The attack chain involves multi-stage infection, delivering malicious backdoors including MiniDoor, PixyNetLoader, and a Covenant Grunt implant. The campaign employs social engineering lures in multiple languages, server-side evasion techniques, and abuses the Filen API for command-and-control communications. The malware components utilize various persistence mechanisms, steganography, and anti-analysis techniques. The operation showcases APT28's evolving tactics, techniques, and procedures in weaponizing the latest vulnerabilities.",
  "published": "2026-02-02T21:44:54+00:00",
  "created_at": "2026-02-02T21:44:54+00:00",
  "modified_at": "2026-02-03T08:49:37+00:00",
  "created_at_opencti": "2026-02-02T21:44:54+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-02-02",
    "CVE-2026-21509",
    "covenant grunt",
    "filen api",
    "minidoor",
    "operation neusploit",
    "pixynetloader",
    "rtf exploit",
    "steganography"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://freefoodaid.com/tables/tables.d"
      },
      {
        "id": "",
        "name": "https://freefoodaid.com/documents/2_2.lNk"
      },
      {
        "id": "",
        "name": "https://freefoodaid.com/documents/2_2.d"
      },
      {
        "id": "",
        "name": "bb23545380fde9f48ad070f88fe0afd695da5fcae8c5274814858c5a681d8c4e"
      },
      {
        "id": "",
        "name": "5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02"
      },
      {
        "id": "",
        "name": "b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546"
      },
      {
        "id": "",
        "name": "1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f50"
      },
      {
        "id": "",
        "name": "9f4672c1374034ac4556264f0d4bf96ee242c0b5a9edaa4715b5e61fe8d55cc8"
      },
      {
        "id": "",
        "name": "fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b"
      },
      {
        "id": "",
        "name": "c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f"
      },
      {
        "id": "",
        "name": "a944a09783023a2c6c62d3601cbd5392a03d808a6a51728e07a3270861c2a8ee"
      },
      {
        "id": "",
        "name": "a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1"
      },
      {
        "id": "",
        "name": "3f446d316efe2514efd70c975d0c87e12357db9fca54a25834d60b28192c6a69"
      },
      {
        "id": "",
        "name": "2822c72a59b58c00fc088aa551cdeeb92ca10fd23e23745610ff207f53118db9"
      },
      {
        "id": "",
        "name": "0bb0d54033767f081cae775e3cf9ede7ae6bea75f35fbfb748ccba9325e28e5e"
      }
    ],
    "malware": [
      {
        "id": "883f2cab-5fa2-49e3-82c9-39052ed3d79d",
        "name": "MiniDoor",
        "slug": "minidoor"
      },
      {
        "id": "66a92bfe-6cd9-4b88-8c6e-b65ba0366991",
        "name": "Covenant Grunt",
        "slug": "covenant-grunt"
      },
      {
        "id": "ea2ada92-6ad5-4aba-9679-541f11c1c433",
        "name": "PixyNetLoader",
        "slug": "pixynetloader"
      }
    ],
    "intrusion_sets": [
      {
        "id": "2e5c75e1-c481-46c4-8d26-f0774a3457fa",
        "name": "APT28",
        "slug": "apt28"
      }
    ],
    "attack_patterns": [
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "de38dd3a-41d7-4621-8a00-a32d7f0ff420",
        "name": "T1102.002"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "e46a9411-d2a1-47c9-8820-c7f818f4c0b5",
        "name": "T1203"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2026-21509"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Slovakia"
      },
      {
        "id": "",
        "name": "Romania"
      },
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "wellnesscaremed.com"
      },
      {
        "id": "",
        "name": "freefoodaid.com"
      }
    ]
  },
  "external_refs": [
    "https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit",
    "https://otx.alienvault.com/pulse/698128e65e8a9984e3ff5b7e"
  ]
}