Automatically translated.View original post

Russian hackers exploit vulnerability on Microsoft Office

Russian hackers exploit vulnerability on Microsoft Office, release spying malware down victim machine

When it comes to software for use within a long-known office, it can't escape. Microsoft Office, which has later diminished its popularity from more alternatives, but it is still the software of the office. Yet, it has so many security vulnerabilities that it is in favor of hackers, as in this case.

According to a report by the website, The Hacker News mentioned the detection of a new campaign by the hacker group APT28, known as UAC-0001 from Russia, in the use of a Microsoft Office security vulnerability coded CVE-2026-21509, which has a danger rating, or CVSS Score, of up to 7.8. This vulnerability is a security feature bypass vulnerability, resulting in hackers being able to send Microsoft Office files created for a special purpose, sending them to trick the victim into opening them, which leads to malware implantation, according to a research team from Zscaler ThreatLabz. The company, an expert in building security solutions, named the hacker operation that detected Operation Neusploit by a group of research teams that detected the campaign before it was named. It was the work of a research team from Microsoft itself and Google: Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC), and Office Product Group Security Team, and Google Threat Intelligence Group (GTIG).

For its part, the attack starts with hackers using deception in the form of social engineering, via phishing email in different languages, depending on which country the victim lives in, while the server side is set up to detect which country the download request came from. The request must only come from the designated country to the server to release a DLL file, a malware file (payload) to the victim's machine. Currently, the hackers have focused on tackling European countries such as Ukraine, Greece, Turkey, Poland, Slovenia. And Middle East countries like the Arab Emirates, where hackers impersonate government organizations to build trust in victims.

Within the fraudulent email mentioned above, inside a Microsoft Office document of the type .RTF or .DOC is attached, which will lead to downloading 2 per-bird malware (Loader).

Verse malware for downloading and installing MiniDoor malware, which is malware for data theft or Infostealer. The emails on Microsoft Outlook software in both Inbox, Junk, and Drafts are sent back to hackers via an email address that is saved as a fixed value (Hardcoded) on malware like ahmeclaw2002@outlook [.] com and ahmeclaw@proton [.] me. This malware comes as a DLL file written on the C + + language. This malware, based on in-depth investigation, has been found to be a malware modified from NotDoor (or GONEPOSTAL) malware.

The malware called PixyNetLoader, used for downloading hacking tools, is called COVENANT. This malware is more complex than the first fowl malware, which initiates a chain attack on the victim or Chain Attack.

In the PixyNetLoader malware section, PixyNetLoader will start by loading a Components element embedded (Embeded) in the Loader. The unlocked file contains a Shellcode Loader in the DLL file format called "EhStoreShell.dll," and an image in the PNG file format called "SplashScreen.png." The Shellcode Loader extracts a Shellcode embedded in the image file for Execution. This Loader will only work if it is not detected in the environment in which the file is being analyzed, and the process that extracts the DLL file. The Loader must be "explorer." If the condition is not complete, the malware will be embedded in the system.

The decoded Shellcode will lead to the loading of the COVENANT hacking tool in the .NET Assembly format, which will connect the control and control network or C2 (Command and Control) to the victim's machine. In addition to embedding malware, the Loader also serves to create system persistence by using COM Object Hijacking.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # hackers

2/26 Edited to

... Read moreจากประสบการณ์การทำงานทางด้านความปลอดภัยไซเบอร์ในช่วงหลายปีที่ผ่านมา ช่องโหว่ของซอฟต์แวร์ที่ใช้งานอย่างแพร่หลาย เช่น Microsoft Office มักกลายเป็นเป้าหมายหลักของแฮกเกอร์ เนื่องจากมีจำนวนผู้ใช้งานมากและเสี่ยงต่อการถูกโจมตีแบบแพร่หลายเหมือนที่แคมเปญ Operation Neusploit ของกลุ่ม APT28 ใช้ช่องโหว่ CVE-2026-21509 นี้เป็นต้น หนึ่งในสิ่งที่ผมย้ำเสมอคือการจัดการและอัปเดตซอฟต์แวร์อย่างสม่ำเสมอเพื่อลดช่องโหว่เหล่านี้ โดยเฉพาะกับระบบสำนักงานที่มีการใช้งานเอกสารที่มาจากภายนอก การฝึกอบรมพนักงานให้รู้จักกับภัยคุกคามรูปแบบฟิชชิง และไม่เปิดไฟล์จากแหล่งที่ไม่น่าเชื่อถือ ถือเป็นแนวทางเบื้องต้นแต่มีประสิทธิภาพสูง การโจมตีรูปแบบนี้ใช้ประโยชน์จากไฟล์เอกสาร Microsoft Office ประเภท .RTF หรือ .DOC ที่ฝังมัลแวร์ซับซ้อน ไม่เพียงแค่ดาวน์โหลดมัลแวร์ MiniDoor เพื่อขโมยข้อมูลอีเมล แต่ยังใช้ PixyNetLoader เพื่อติดตั้งเครื่องมือสำหรับการแฮกที่มีความซับซ้อนเพิ่มขึ้นอย่าง COVENANT ซึ่งมีการทำงานด้วยเทคโนโลยี .NET Assembly และใช้เทคนิคการฝังตัวแบบ COM Object Hijacking เพื่อทำให้มัลแวร์อยู่ยาวนานในระบบ สิ่งที่น่าสนใจคือวิธีที่ Shellcode ถูกฝังซ่อนในไฟล์รูปภาพ PNG และมีการตรวจสอบสภาพแวดล้อมที่รันมัลแวร์อย่างละเอียดเพื่อหลบเลี่ยงการวิเคราะห์ เช่น ต้องรันใน Process explorer.exe เท่านั้น ซึ่งแสดงให้เห็นถึงความพยายามของแฮกเกอร์ในการหลีกเลี่ยงการตรวจจับอย่างสูง ผมแนะนำว่าผู้ดูแลระบบ IT และผู้ใช้งานองค์กร ควรเพิ่มมาตรการตรวจสอบไฟล์ที่รับเข้ามาอย่างเข้มงวด และพิจารณาใช้งานระบบป้องกัน Endpoint Detection and Response (EDR) เพื่อจับพฤติกรรมที่ผิดปกติของมัลแวร์ นอกจากนี้การจัดตั้งระบบแจ้งเตือนและวิเคราะห์ภัยคุกคามแบบเรียลไทม์จะช่วยลดความเสียหายหากมีการโจมตีเกิดขึ้น สุดท้าย เรื่องนี้ย้ำเตือนให้ทุกคนตระหนักว่าการรักษาความปลอดภัยไซเบอร์เป็นเรื่องที่ต้องทำอย่างต่อเนื่อง ไม่ใช่แค่การติดตั้งแอนตี้ไวรัสหรือแพตช์เพียงครั้งเดียว แต่ต้องมีการวางกลยุทธ์ ปรับปรุงความรู้ และติดตามสถานการณ์ภัยคุกคามล่าสุดอยู่เสมอครับ

Related posts

SIEGEX is all CHEATERS & HACKERS😭
Why is this game full of cheaters and hackers and bugs🤷‍♀️ #siege #rainbowsixsiege #gaming #streamer #foryou
Phasma

Phasma

35 likes

A young woman with long dark hair, wearing a pink satin shirt, smiles at the camera while sitting at a table. Overlay text reads: 'Tools and sites I use as a cybersecurity student to progress my skills and keep me interested in studying'.
A screenshot of 'The Hacker News' website, displaying various cybersecurity news articles from January 2025, including topics like vulnerabilities, malware, cyber espionage, and AI jailbreak methods. An ad for Zscaler and a banner for CIS Hardened Images are also visible.
A screenshot of the O'Reilly learning platform, showing various books and expert playlists related to AI, engineering, and data. Overlay text highlights the subscription cost ($50/month or $499/year) and its value for accessing books and live events.
Tools and sites I use as a cybersecurity student 🌸
#cybersecuritystudent #cybersecurity #techgirlie
LexiStudies

LexiStudies

107 likes

Do you like hackers?
#hacker #hackers #tricked #fyp
Lil Conscious

Lil Conscious

38 likes

info narcissist and dating tips lol
#toxicmen #cheaters #embracevulnerability #Lemon8Diary #controllingmen
andrea35reiss

andrea35reiss

124 likes

Some people help just to gain leverage & control. Others watch you struggle just to keep power. Both are manipulation. #darktriad #narcissist #fyp #truth #higherconsciousness
Spiritual Detective 🕵🏽‍♀️

Spiritual Detective 🕵🏽‍♀️

169 likes

#yungblud
watch4hackers

watch4hackers

6 likes

Taco Tuesday 🤯 Admin Abuse ⁉️ #stealabrainrot #robloxstealabrainrot #roblox #neoskittles
NeoSkittles

NeoSkittles

6 likes

The Right Partner Lifts, Not Drains #creatorsearchinsights #narcissist #embracevulnerability
Au Di

Au Di

5 likes

scammers and hackers beware
Hudson
cercofhell

cercofhell

28 likes

WARZONE HACKERS
Warzone is full hackers and call of duty does not care #warzone #hacker #memesdaily #memes🤣 #gaming
DUSTINMYRQ ™

DUSTINMYRQ ™

4 likes

A laptop with a cloudy sky wallpaper and a white cup with a red logo. Text overlay reads: 'Free Websites That Saved My GPA AND MY SANITY Sharing So You Don't Struggle Too'.
A laptop screen displays Yahoo search results for 'Quizlet'. An overlay describes Quizlet as a free flashcard tool for memorizing terms, definitions, and formulas, making studying feel like a game.
A laptop screen displays Yahoo search results for 'Unriddle.ai'. An overlay describes Unriddle.ai as a free tool that breaks down notes, articles, or assignments to aid understanding of long readings.
Websites You NEED to Pass Your College Courses
Y’all college is hard enough without trying to figure everything out on your own 😩 So here’s my list of websites that actually helped me pass my classes like, these were in my survival kit. I’m not gatekeeping 🫶🏽 Quizlet When I needed to memorize terms FAST. I used it for flashcards, and the matc
Beauty

Beauty

280 likes

BIG Holiday Costco Shop & Haul | Anchorage, Alaska
vanditsv

vanditsv

2 likes

You shouldn’t be worried about the hackers, you should be worried about your settings. Check out ThreatLocker DAC today #ad #cybersecurity
Cybersecurity Girl

Cybersecurity Girl

28 likes

Hackers are using tricks & steal financial info.🌸🍋
SECURITY TIPS: Be careful from hackers they use multiple different types of software and tricks to steal data from computers, cell phones or other devices to steal your data, financial information and personal details. When they hack via computer systems Showing they are from Microsoft Security Ale
Mujahid Bakht

Mujahid Bakht

6 likes

Kalebdavis19

Kalebdavis19

1 like

me rocking the shades yesterday at my day group ☺️
Øg Hackers Dèmøn

Øg Hackers Dèmøn

1 like

Replying to @Red what parts or the dark web live in your brain rent free? #scarystories #horror #eductional #darkweb
Liz Cooper🦋

Liz Cooper🦋

42 likes

I wanted a real project I could actually show, not just talk about. So I used Atoms ⚛️ Check it out here: https://tinyurl.com/3xzc8xbe It feels like having a whole AI team helping me: 🔍 they do the deep research first 🏁 then Race Mode builds different versions so I can compare 👥 I just pick
emilie.studygram

emilie.studygram

19 likes

A message to Minecraft hackers…
You should join the server #minecraft #gaming #fyp
BendersMC

BendersMC

13 likes

Look world on all my Instagram accounts right now rejecting all my reels and posts and won't let me share them the 3rd one Look world just locked my new Facebook account chosen Akins cause I'm sharing my legal paperwork and federal complaints and exposing them this a new Facebook account I&
glentrump359

glentrump359

0 likes

US Treasury Cyberattack Update
#cybersecurity #cyberattacks #ustreasury
Lemon8er

Lemon8er

2 likes

Break… 💫🐍
💫🐍 #medusajele #spiritual #god #embracevulnerability #unfiltered
MedusaJele 💫🐍

MedusaJele 💫🐍

0 likes

A phone displaying the ChatGPT app interface with text overlay 'my Chat GPT got hacked' and 'essential security steps I wish I did sooner', alongside the ChatGPT logo.
Text explaining a ChatGPT account hack due to session token access, with random chats appearing. It introduces security steps, shown with a stylized ChatGPT interface.
Instructions on how to 'Turn On 2FA' for ChatGPT, detailing steps to enable multi-factor authentication in settings, with a screenshot showing the 'Enabled' status.
ChatGPT Security Settings You Shouldn’t Skip 🔐
So… my ChatGPT account got hacked 😳 Someone got access to my session token and random people started chats on my account. I could literally see everything happening in real time. Here are the basic security steps I really wish I had done earlier 👇 📌 Turn on 2FA - adds an extra layer of prote
Unrealtoreal

Unrealtoreal

180 likes

warzone hackers be mad little babies
#cod #ps5 #gamergirl #warzone #fuckhackers
Twilightvile

Twilightvile

2 likes

Hackers Dream
🕶 Digital Survival Duo "What if the real threat wasn’t in the email… but hidden in the vacation photo you just opened?" Remote Access Terminal (R.A.T.) and Image Hunter are not theory — they’re step-by-step, copy-paste-ready manuals with real, verifiable code. Learn exactly how attackers
Dark Meta

Dark Meta

11 likes

Not everyone is hacking‼️
#callofduty #hacking #hacker #hackers #embracevulnerability Titusville
SeB The One

SeB The One

1 like

Replying to @Brooke I built a nonprofit to hold space for grief like this. I showed up & I broke when it was safe to. @The Silent Mother Project #livingrichardson #thesilentmotherproject #cptsd #trauma #bringryanhome
Sam Richardson

Sam Richardson

1 like

The image shows a keyboard with a fingerprint icon, overlaid with "OUTSMART HACKERS" and "Secrets they don't want you to know," serving as the title for a guide on cybersecurity.
This image explains hackers use software to guess passwords and advises creating long passwords with a random mix of letters, numbers, and symbols to defend against such attacks.
The image warns that hackers try common passwords and advises users to defend themselves by avoiding easy words/phrases and not reusing passwords across different sites.
SECRETS Hackers DON’T Want You to Know!
After hackers got into my Facebook account and completely erased it, I dusted myself off and started a deep dive to understand why and how hackers work. The best way to protect yourself is to outsmart them. Here are 5 secrets Hackers DON'T want you to know! Share this with everyone! #lemon8pa
techgirljen

techgirljen

425 likes

Look world on all my Instagram accounts right now for 7 days rejecting all my reels and posts and won't let me share my posts Elon Musk and Donald Trump and Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers showing favoritism and discriminate against Glen Nickolas Ak
glentrump359

glentrump359

0 likes

Look world on my new Snapchat right now want let anyone see my stories rejecting all of them Elon Musk and Donald Trump and Mark Zuckerberg and Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers everyday all day and night and morning harassing me on all my social media ap
glentrump359

glentrump359

0 likes

King Trump
GrouchyGrandpaChannel

GrouchyGrandpaChannel

4 likes

Hackers
How call of duty has me #call of duty #hacker #warzone
Stevie_Wonders

Stevie_Wonders

1 like

A rumor has been going around that Iranian hackers threatened to hack the U.S. credit system and boost everyone’s credit score. #fyp
iddy2707

iddy2707

2 likes

Hackers Be Like:
#fypage
AidenIsMyself

AidenIsMyself

0 likes

An Instagram account suspension notice for 'Mike Bad' indicates 180 days to appeal before permanent disablement. The suspension, effective April 16, 2026, is due to potential association with another rule-violating account, affecting account integrity. The account is currently not visible or usable.
Look world I just made this Instagram account right now Elon Musk and Donald Trump and Mark Zuckerberg and Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers just login me out of it showing favoritism and discriminate against Glen Nickolas Akins this is against my federal
glentrump359

glentrump359

0 likes

Look world Elon Musk and Donald Trump and Mark Zuckerberg and Morehouse parish sheriff department officers and Mike Stone Tubbs and hackers just locked and removed my lives for no reason cause I'm speaking my freedom of speech constitutional rights and laws FBI and state police DEA and governme
glentrump359

glentrump359

0 likes

Look world deactivated all my Instagram accounts cause I was at a 1000 friends to go go live and removing all my legal paperwork and complaints tampering with federal evidence Elon Musk and Donald Trump and Mark Zuckerberg and Morehouse parish sheriff department officers and Mike Stone Tubbs and ha
glentrump359

glentrump359

0 likes

Look world just locked my new Facebook account right now cause I'm showing complaints and legal paperwork I'm filling right now Look world at 2:00 am am Jamie Winfield and Tracy Winfield and Dre Washington and Randy Tappin and Christopher Thirdkill and IT drinking and smoking and using drug
glentrump359

glentrump359

0 likes

Ban Hackers
Vinicius Jr 🇧🇷 #fcmobile #eafcmobile #fifamobile #fcmobile25 #eafc
manuelofficial_13

manuelofficial_13

1 like

Hackers Bypass Microsoft Security Controls
Hackers have advertised a claim that they successfully bypassed Microsoft’s product activation process and can activate any Microsoft product without the activation process. #cyber #hacker #microsoft #cybersecurity
Lemon8er

Lemon8er

2 likes

Look world on all my Instagram accounts right now login me out of them for no reason I haven't been on there Instagram accounts these meth heads going crazy frfr on God Jesus Christ God Jesus Christ God y'all need some serious help on God Morehouse parish sheriff department officers and Mik
glentrump359

glentrump359

0 likes

I'm finna to go filing some more federal complaints on y'all right now Look world on TikTok right now removing my freedom of speech constitutional rights and sound on my legal paperwork and complaints Look world on Lemon8 app right now removing my legal paperwork complaints and freedom of
glentrump359

glentrump359

1 like

Bigfoot Super Hackers.
#manthoughts #hackers #laughoutloud #bigfootvlog #lifetips
Alien Hayes

Alien Hayes

11 likes

BlueHammer Privilege Escalation in Defender
BlueHammer Privilege Escalation in Defender | Wordfence Security News Clip | April 13, 2026 A privilege escalation zero-day in Microsoft Defender was patched as part of the April 2026 Patch Tuesday cycle. The flaw is linked to a public exploit called BlueHammer, published to GitHub on April 3rd
Wordfence

Wordfence

1 like

See more