APT28 Exploits Microsoft Office Zero-Day in Targeted Cyberattacks A Russia-linked threat group, UAC-0001 (APT28), has been actively exploiting a critical zero-day vulnerability (CVE-2026-21509) in Microsoft Office to deploy malware against Ukrainian government entities and European Union organizations. The flaw was disclosed by Microsoft on January 26, 2026, with warnings of in-the-wild exploitation threat actors weaponized the vulnerability within 24 hours of public disclosure. The rapid weaponization underscores the challenges defenders face against state-sponsored groups, as traditional prevention strategies struggle to keep pace. The attacks highlight the need for rapid patching, endpoint visibility, and containment measures to limit lateral movement and mitigate damage. No further details on the malware or specific targets have been released.