Automatically translated.View original post

Russian hackers exploit vulnerability on Microsoft Office

Russian hackers exploit vulnerability on Microsoft Office, release spying malware down victim machine

When it comes to software for use within a long-known office, it can't escape. Microsoft Office, which has later diminished its popularity from more alternatives, but it is still the software of the office. Yet, it has so many security vulnerabilities that it is in favor of hackers, as in this case.

According to a report by the website, The Hacker News mentioned the detection of a new campaign by the hacker group APT28, known as UAC-0001 from Russia, in the use of a Microsoft Office security vulnerability coded CVE-2026-21509, which has a danger rating, or CVSS Score, of up to 7.8. This vulnerability is a security feature bypass vulnerability, resulting in hackers being able to send Microsoft Office files created for a special purpose, sending them to trick the victim into opening them, which leads to malware implantation, according to a research team from Zscaler ThreatLabz. The company, an expert in building security solutions, named the hacker operation that detected Operation Neusploit by a group of research teams that detected the campaign before it was named. It was the work of a research team from Microsoft itself and Google: Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC), and Office Product Group Security Team, and Google Threat Intelligence Group (GTIG).

For its part, the attack starts with hackers using deception in the form of social engineering, via phishing email in different languages, depending on which country the victim lives in, while the server side is set up to detect which country the download request came from. The request must only come from the designated country to the server to release a DLL file, a malware file (payload) to the victim's machine. Currently, the hackers have focused on tackling European countries such as Ukraine, Greece, Turkey, Poland, Slovenia. And Middle East countries like the Arab Emirates, where hackers impersonate government organizations to build trust in victims.

Within the fraudulent email mentioned above, inside a Microsoft Office document of the type .RTF or .DOC is attached, which will lead to downloading 2 per-bird malware (Loader).

Verse malware for downloading and installing MiniDoor malware, which is malware for data theft or Infostealer. The emails on Microsoft Outlook software in both Inbox, Junk, and Drafts are sent back to hackers via an email address that is saved as a fixed value (Hardcoded) on malware like ahmeclaw2002@outlook [.] com and ahmeclaw@proton [.] me. This malware comes as a DLL file written on the C + + language. This malware, based on in-depth investigation, has been found to be a malware modified from NotDoor (or GONEPOSTAL) malware.

The malware called PixyNetLoader, used for downloading hacking tools, is called COVENANT. This malware is more complex than the first fowl malware, which initiates a chain attack on the victim or Chain Attack.

In the PixyNetLoader malware section, PixyNetLoader will start by loading a Components element embedded (Embeded) in the Loader. The unlocked file contains a Shellcode Loader in the DLL file format called "EhStoreShell.dll," and an image in the PNG file format called "SplashScreen.png." The Shellcode Loader extracts a Shellcode embedded in the image file for Execution. This Loader will only work if it is not detected in the environment in which the file is being analyzed, and the process that extracts the DLL file. The Loader must be "explorer." If the condition is not complete, the malware will be embedded in the system.

The decoded Shellcode will lead to the loading of the COVENANT hacking tool in the .NET Assembly format, which will connect the control and control network or C2 (Command and Control) to the victim's machine. In addition to embedding malware, the Loader also serves to create system persistence by using COM Object Hijacking.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # hackers

2/26 Edited to

... Read moreจากประสบการณ์การทำงานทางด้านความปลอดภัยไซเบอร์ในช่วงหลายปีที่ผ่านมา ช่องโหว่ของซอฟต์แวร์ที่ใช้งานอย่างแพร่หลาย เช่น Microsoft Office มักกลายเป็นเป้าหมายหลักของแฮกเกอร์ เนื่องจากมีจำนวนผู้ใช้งานมากและเสี่ยงต่อการถูกโจมตีแบบแพร่หลายเหมือนที่แคมเปญ Operation Neusploit ของกลุ่ม APT28 ใช้ช่องโหว่ CVE-2026-21509 นี้เป็นต้น หนึ่งในสิ่งที่ผมย้ำเสมอคือการจัดการและอัปเดตซอฟต์แวร์อย่างสม่ำเสมอเพื่อลดช่องโหว่เหล่านี้ โดยเฉพาะกับระบบสำนักงานที่มีการใช้งานเอกสารที่มาจากภายนอก การฝึกอบรมพนักงานให้รู้จักกับภัยคุกคามรูปแบบฟิชชิง และไม่เปิดไฟล์จากแหล่งที่ไม่น่าเชื่อถือ ถือเป็นแนวทางเบื้องต้นแต่มีประสิทธิภาพสูง การโจมตีรูปแบบนี้ใช้ประโยชน์จากไฟล์เอกสาร Microsoft Office ประเภท .RTF หรือ .DOC ที่ฝังมัลแวร์ซับซ้อน ไม่เพียงแค่ดาวน์โหลดมัลแวร์ MiniDoor เพื่อขโมยข้อมูลอีเมล แต่ยังใช้ PixyNetLoader เพื่อติดตั้งเครื่องมือสำหรับการแฮกที่มีความซับซ้อนเพิ่มขึ้นอย่าง COVENANT ซึ่งมีการทำงานด้วยเทคโนโลยี .NET Assembly และใช้เทคนิคการฝังตัวแบบ COM Object Hijacking เพื่อทำให้มัลแวร์อยู่ยาวนานในระบบ สิ่งที่น่าสนใจคือวิธีที่ Shellcode ถูกฝังซ่อนในไฟล์รูปภาพ PNG และมีการตรวจสอบสภาพแวดล้อมที่รันมัลแวร์อย่างละเอียดเพื่อหลบเลี่ยงการวิเคราะห์ เช่น ต้องรันใน Process explorer.exe เท่านั้น ซึ่งแสดงให้เห็นถึงความพยายามของแฮกเกอร์ในการหลีกเลี่ยงการตรวจจับอย่างสูง ผมแนะนำว่าผู้ดูแลระบบ IT และผู้ใช้งานองค์กร ควรเพิ่มมาตรการตรวจสอบไฟล์ที่รับเข้ามาอย่างเข้มงวด และพิจารณาใช้งานระบบป้องกัน Endpoint Detection and Response (EDR) เพื่อจับพฤติกรรมที่ผิดปกติของมัลแวร์ นอกจากนี้การจัดตั้งระบบแจ้งเตือนและวิเคราะห์ภัยคุกคามแบบเรียลไทม์จะช่วยลดความเสียหายหากมีการโจมตีเกิดขึ้น สุดท้าย เรื่องนี้ย้ำเตือนให้ทุกคนตระหนักว่าการรักษาความปลอดภัยไซเบอร์เป็นเรื่องที่ต้องทำอย่างต่อเนื่อง ไม่ใช่แค่การติดตั้งแอนตี้ไวรัสหรือแพตช์เพียงครั้งเดียว แต่ต้องมีการวางกลยุทธ์ ปรับปรุงความรู้ และติดตามสถานการณ์ภัยคุกคามล่าสุดอยู่เสมอครับ

Related posts

Tools and sites I use as a cybersecurity student 🌸
#cybersecuritystudent #cybersecurity #techgirlie
LexiStudies

LexiStudies

102 likes

scammers and hackers beware
Hudson
cercofhell

cercofhell

28 likes

Awareness is protection. Recognize the patterns.
It was never random. They selected you. Know the signs. Trust your instincts. Awareness saves lives. #skeletoncrewcreations #truecrimecommunity #truecrimetok #truecrimeaddict #protectionskills
skeleton_crew_creations

skeleton_crew_creations

480 likes

SIEGEX is all CHEATERS & HACKERS😭
Why is this game full of cheaters and hackers and bugs🤷‍♀️ #siege #rainbowsixsiege #gaming #streamer #foryou
Phasma

Phasma

28 likes

info narcissist and dating tips lol
#toxicmen #cheaters #embracevulnerability #Lemon8Diary #controllingmen
andrea35reiss

andrea35reiss

83 likes

Kalebdavis19

Kalebdavis19

0 likes

Amen thanks Father God Jesus Christ God morning word and prayer devil's I rebuke you your childrens Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers and Elon Musk and Donald Trump and Mark Zuckerberg and Randy Tappin and Christopher Thirdkill and IT and their countr
glentrump359

glentrump359

0 likes

BIG Holiday Costco Shop & Haul | Anchorage, Alaska
vanditsv

vanditsv

1 like

SECRETS Hackers DON’T Want You to Know!
After hackers got into my Facebook account and completely erased it, I dusted myself off and started a deep dive to understand why and how hackers work. The best way to protect yourself is to outsmart them. Here are 5 secrets Hackers DON'T want you to know! Share this with everyone! #lemon8pa
techgirljen

techgirljen

424 likes

Hackers Dream
🕶 Digital Survival Duo "What if the real threat wasn’t in the email… but hidden in the vacation photo you just opened?" Remote Access Terminal (R.A.T.) and Image Hunter are not theory — they’re step-by-step, copy-paste-ready manuals with real, verifiable code. Learn exactly how attackers
Dark Meta

Dark Meta

9 likes

Some people help just to gain leverage & control. Others watch you struggle just to keep power. Both are manipulation. #darktriad #narcissist #fyp #truth #higherconsciousness
Spiritual Detective 🕵🏽‍♀️

Spiritual Detective 🕵🏽‍♀️

164 likes

Nae Recently…📖
Recently I decided to take a break from tik tok and instagram. Safe to say life has been so much easier. I feel like I’ve been less distracted and keeping my mind at ease. Yes, Lemon8 is still a form of social media but I don’t even be on here like that. I definitely recommend it. ❣️ #embracevulne
xanni monae

xanni monae

0 likes

Do you like hackers?
#hacker #hackers #tricked #fyp
Lil Conscious

Lil Conscious

38 likes

FBI and state police DEA and government judicial and president come get Elon Musk and Mark Zuckerberg and Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers I trying to go live on TikTok 6 they put restriction on all 6 of them to lock my lives and on YouTube channel right
glentrump359

glentrump359

0 likes

BIG Holiday Costco Shop & Haul | Anchorage, Alaska
vanditsv

vanditsv

2 likes

#yungblud
watch4hackers

watch4hackers

5 likes

Websites You NEED to Pass Your College Courses
Y’all college is hard enough without trying to figure everything out on your own 😩 So here’s my list of websites that actually helped me pass my classes like, these were in my survival kit. I’m not gatekeeping 🫶🏽 Quizlet When I needed to memorize terms FAST. I used it for flashcards, and the matc
Beauty

Beauty

272 likes

Look world Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers and Elon Musk and Donald Trump and Mark Zuckerberg rejecting all my followers on my Snapchat right now these meth heads going crazy frfr
glentrump359

glentrump359

4 likes

ChatGPT Security Settings You Shouldn’t Skip 🔐
So… my ChatGPT account got hacked 😳 Someone got access to my session token and random people started chats on my account. I could literally see everything happening in real time. Here are the basic security steps I really wish I had done earlier 👇 📌 Turn on 2FA - adds an extra layer of prote
Unrealtoreal

Unrealtoreal

176 likes

God, please unblock this android, hackers have in
Olga Ledbetter

Olga Ledbetter

37 likes

Amen thanks Father God Jesus Christ God morning word and prayer devil's I rebuke you your childrens Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers and Elon Musk and Donald Trump and Mark Zuckerberg and Randy Tappin and Christopher Thirdkill and IT and their countr
glentrump359

glentrump359

0 likes

These meth heads going crazy Elon Musk and Donald Trump and Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers just locked my Facebook accounts right now for no reason y'all obsessed with me gay bitches unlocked my damn Facebook account
glentrump359

glentrump359

0 likes

Tips For Increasing YOUR Cyber Security! 🛜👩🏼‍💻
Cybersecurity is a topic I do NOT take lightly! As someone who once wanted to be a white hat hacker (aka ethical hacker) growing up - among other things, lol - I think it’s important that we all stay informed and up to date with our cybersecurity. Personally, I don’t follow every single tip out
digitally.kate

digitally.kate

17 likes

Bigfoot Super Hackers.
#manthoughts #hackers #laughoutloud #bigfootvlog #lifetips
Alien Hayes

Alien Hayes

11 likes

I wanted a real project I could actually show, not just talk about. So I used Atoms ⚛️ Check it out here: https://tinyurl.com/3xzc8xbe It feels like having a whole AI team helping me: 🔍 they do the deep research first 🏁 then Race Mode builds different versions so I can compare 👥 I just pick
emilie.studygram

emilie.studygram

19 likes

Still endind lives on bingo live right now Fuck y'all Elon Musk and Donald Trump and Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers
glentrump359

glentrump359

0 likes

Look world on my Instagram accounts right now rejecting all my reels and posts and won't let me share my posts and reels Look world lock my new Facebook account again for no reason cause I'm sharing my complaints I'm filling right these meth heads going crazy frfr on God Look world on m
glentrump359

glentrump359

0 likes

Top cybersecurity-related GitHub projects
My top GitHub list for cybersecurity projects is updated for this month 😎👆 Explore top-ranked FOSS projects spanning both the defensive and offensive sides of cybersecurity. Find a high-res pdf book with all my cybersecurity related infographics from https://study-notes.org #cybersecurity
Dan Nanni

Dan Nanni

26 likes

Instagram is sharing your exact location to all your followers Turn this off ASAP. #techtips #instagram #news #technews
Cybersecurity Girl

Cybersecurity Girl

201 likes

THURSDAY | 19 MARCH 2026 | Cybersecurity Report
The digital world is on fire this Thursday, March 19, 2026. From "perfect 10" zero-days to massive healthcare leaks, host Arias Thomas breaks down the breaches you need to know about RIGHT NOW. On today’s briefing: 🔴 Cisco Under Fire: The Interlock ransomware group is weaponizing a CVSS
Cyber F.M.

Cyber F.M.

0 likes

You shouldn’t be worried about the hackers, you should be worried about your settings. Check out ThreatLocker DAC today #ad #cybersecurity
Cybersecurity Girl

Cybersecurity Girl

27 likes

The Right Partner Lifts, Not Drains #creatorsearchinsights #narcissist #embracevulnerability
Au Di

Au Di

4 likes

Columbus blue jackets hockey
Had a good time watching the bluejackets vs St. Louis blues pre season game! New vlog on the YouTube d channel up now! #columbusbluejackets #hockey #stlouisblues #follow
Kalebdavis19

Kalebdavis19

16 likes

King Trump
GrouchyGrandpaChannel

GrouchyGrandpaChannel

4 likes

Familiar patterns in Trauma cycles
Empaths and narcissists usually attract one another as a result of trauma bonding. This bond is rarely coincidental—it is forged in the unseen echoes of past pain and unhealed wounds. Both empaths and narcissists often emerge from childhoods marked by trauma, neglect, or emotional chaos. Yet the pa
Hot Rod 🇨🇦

Hot Rod 🇨🇦

9 likes

We Hear So Much but See So Little…
Why ppl always talk about the Epstein files like they are some hidden treasure of truth. Names. Proof. Everything. But years keep passing and nothing real comes out. Just rumors and arguing online. It makes me wonder if the files are locked away deeper than we think. Or if powerful people have
heyynick

heyynick

64 likes

Hackers are using tricks & steal financial info.🌸🍋
SECURITY TIPS: Be careful from hackers they use multiple different types of software and tricks to steal data from computers, cell phones or other devices to steal your data, financial information and personal details. When they hack via computer systems Showing they are from Microsoft Security Ale
Mujahid Bakht

Mujahid Bakht

6 likes

Look world lock my new Facebook account again for no reason cause I'm sharing my complaints I'm filling right these meth heads going crazy frfr on God Look world on my new Facebook account right now rejecting all my reels now just locked it for no reason These meth heads going crazy Elon Mu
glentrump359

glentrump359

0 likes

The Psychology Hack Every Young Professional Needs
💡 Why You Need This Book Ever wonder why smart people still get played? The Confidence Game by Maria Konnikova breaks down how cons exploit human psychology—yes, even yours. A must-read for young professionals navigating corporate politics, networking, and deal-making. If you think you're too
Noelle

Noelle

62 likes

Amen thanks Father God Jesus Christ God morning word and prayer devil's I rebuke you your childrens Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers and Elon Musk and Donald Trump and Mark Zuckerberg and Randy Tappin and Christopher Thirdkill and IT and their countr
glentrump359

glentrump359

0 likes

Look world on my new Facebook account right now removing my freedom of speech constitutional rights and laws and rejecting all my posts and won't let me share my posts Look world on all my Instagram accounts right now again the 5th day rejecting all my reels and posts and won't let me share
glentrump359

glentrump359

0 likes

Amen thanks Father God Jesus Christ God morning word and prayer devil's I rebuke you your childrens Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers and Elon Musk and Donald Trump and Mark Zuckerberg and Randy Tappin and Christopher Thirdkill and IT and their countr
glentrump359

glentrump359

0 likes

Amen thanks Father God Jesus Christ God evening word and prayer devil's I rebuke you your childrens Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers and Elon Musk and Donald Trump and Mark Zuckerberg and Randy Tappin and Christopher Thirdkill and IT and their countr
glentrump359

glentrump359

0 likes

See more