Shadow in the Sheets: Microsoft Office Zero-Day Breach Unleashes Covert Espionage Wave

It began with a document-harmless in appearance, devastating in effect. Just days after Microsoft revealed a critical zero-day vulnerability in Office, cyber spies struck with chilling speed. Under the guise of Ukrainian government business and European Union briefings, attackers unleashed a stealthy malware campaign, exploiting the world’s most trusted productivity software as a launchpad for espionage against critical infrastructure and government agencies.

Inside the Attack: Rapid Weaponization and Deception

The timeline is startling. Microsoft’s disclosure of CVE-2026-21509 on January 26, 2026, was meant as a warning. Within 48 hours, security researchers spotted the first weaponized document: “Consultation_Topics_Ukraine(Final).doc”, crafted to mimic EU diplomatic paperwork. By January 29, a coordinated phishing campaign was in full swing, with forged bulletins from Ukraine’s Hydrometeorological Center sent to dozens of high-level government inboxes.

Technical analysis reveals a cunning exploitation chain. Victims opening the tainted document unknowingly triggered a connection to attacker-controlled infrastructure via WebDAV. This fetched a shortcut file, which in turn executed a malicious DLL-“EhStoreShell.dll”-masquerading as a legitimate system component. The malware used a cleverly concealed image file (“SplashScreen.png”) to stash executable code, while registry tweaks enabled persistent compromise through COM hijacking. A scheduled task named “OneDriveHealth” ensured the attack would survive reboots and evade casual detection.

What set this campaign apart was its use of legitimate cloud storage (Filen.io) for command-and-control. This tactic allowed the hackers-identified by infrastructure and techniques as APT28, a group tied to Russian intelligence-to blend their traffic with innocent cloud activity, complicating efforts to spot malicious behavior.

By the end of January, multiple European organizations had been targeted. Domains registered just hours before each attack underscored the speed and adaptability of the operation. Microsoft’s urgent guidance-apply registry fixes, update Office, and block suspicious network connections-came as the only shield against an attack window that remained wide open until patches could be widely deployed.

Reflections: The High Price of Delay

This campaign is a stark reminder: in the world of zero-days, every hour counts. As attackers move at digital speed-weaponizing vulnerabilities before defenders can blink-the cost of delay grows ever steeper. For organizations, vigilance, rapid patching, and layered defenses are no longer optional, but essential. In the shadowy war of cyber espionage, the next breach may already be in your inbox.

WIKICROOK

• Zero: A zero-day vulnerability is a hidden security flaw unknown to the software maker, with no fix available, making it highly valuable and dangerous to attackers.
• Phishing: Phishing is a cybercrime where attackers send fake messages to trick users into revealing sensitive data or clicking malicious links.
• Command: A command is an instruction sent to a device or software, often by a C2 server, directing it to perform specific actions, sometimes for malicious purposes.
• COM hijacking: COM hijacking is when attackers alter Windows settings to make the system load their malicious programs instead of legitimate software.
• Persistence: Persistence involves techniques used by malware to survive reboots and stay hidden on systems, often by mimicking legitimate processes or updates.