Russian APT weaponized a Microsoft Office zero-day within 24 hours — fintech was in the crosshairs

January 26, 2026: Microsoft releases an emergency out-of-band patch for CVE-2026-21509, a security feature bypass in Office. January 27, 2026: APT28 — Russia’s GRU-linked cyber-espionage unit — launches Operation Neusploit, weaponizing the same flaw via booby-trapped Office documents. February 9, 2026: the Acronis Threat Research Unit confirms that targeted campaigns continue despite the patch, including victims in the fintech sector.

That timeline isn’t a fluke. It’s the new normal. The gap between a vendor advisory and active exploitation — historically measured in weeks — just dropped below twenty-four hours. And every organization that treats patch day as day one needs a new plan.

What CVE-2026-21509 actually does

CVE-2026-21509 is a security feature bypass in the OLE (Object Linking and Embedding) engine inside Microsoft Office. Microsoft scored it CVSS 7.8 (High). It lets an attacker execute arbitrary code through a malicious Office document — no macro prompt, no security warning, no « Enable Content » banner.

The mechanism is straightforward. Office keeps an internal blocklist of dangerous COM components — effectively kill bits — that it refuses to load inside a document. CVE-2026-21509 sidesteps that check. In practice, a weaponised Word, Excel, or PowerPoint file forces Office to instantiate Shell.Explorer.1 (the embedded Internet Explorer browser control, CLSID {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}), which then loads a remote page or script and executes the attacker’s payload. The victim opens the file. The attacker gets a beachhead. No macros. No clicks beyond the double-click that opens the document.

Every Office version is affected: Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps. Office 2016 and 2019 reached end-of-support on October 14, 2025 — Microsoft issued patches for them at its discretion. The CISA immediately added the flaw to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 16, 2026.

Twenty-four hours, not twenty-four days

On January 27, 2026 — less than a day after the patch dropped — Zscaler ThreatLabz detected active exploitation in the wild. The actor: APT28, also tracked as Fancy Bear, UAC-0001, Strontium, or Sofacy. It’s a cyber-espionage unit tied to Russia’s GRU military intelligence, the same group behind the 2016 DNC breach and countless European government intrusions since.

The campaign, branded Operation Neusploit, used weaponised RTF files delivered through spear-phishing. Once opened, the document deployed Covenant — an open-source command-and-control framework — to take over the compromised machine. No macro warning. No user interaction beyond opening the attachment.

Three things make this worse than your average zero-day cycle.

First, the speed. A twenty-four-hour turnaround doesn’t mean APT28 reverse-engineered the patch and wrote an exploit from scratch overnight. It means they were waiting. They had already identified the vulnerability — likely through diffing earlier Office updates, or through separate intelligence channels — and the public patch was simply the starting gun. This is a race the attacker wins almost every time.

Second, the vector. Document-based phishing is already the number-one initial access vector in espionage campaigns. CVE-2026-21509 removes the last defence. Even a user trained never to click « Enable Content » is helpless: opening the file is all it takes. The attack is invisible to awareness training.

Third, the tail. On February 9, 2026 — a full two weeks after the emergency patch — the Acronis TRU reported that exploitation was ongoing. Unpatched organisations were still being hit. The fix exists; the deployment cadence across large, heterogeneous Office fleets does not match the threat clock.

Why fintech is in the gunsights

Operation Neusploit’s initial targets were governmental: Ukrainian agencies, European Union institutions, and military and transport organisations across Poland, Slovenia, Turkey, Greece, and the UAE. But the Acronis TRU bulletin of February 9, 2026 places this exploitation in a larger context: the fintech sector is explicitly flagged as a target, alongside a separate incident — Betterment’s data exposure affecting 1.4 million accounts.

This isn’t collateral damage. Russian APTs target fintech for three reasons.

Infrastructure access. An initial foothold in a fintech doubles as a stepping stone into partner banks, payment processors, and clearing houses. The sector is interconnected by design.

Data. Fintechs hold bank account details, transaction histories, and verified identity data — exactly the kind of intelligence a state actor needs for profiling or sanctions-evasion operations.

Attack surface. Fintechs are young, product velocity outpaces security maturity, and their people open Office documents all day: contracts, pitch decks, regulatory filings. A booby-trapped document arriving in a legitimate email thread blends right in.

Patching alone doesn’t close the gap

The fix for CVE-2026-21509 is available across all affected versions. Microsoft 365 Apps and Office LTSC 2024/2021 are protected automatically through a service-side change — restarting Office applications applies the patch. Older versions require manual updates.

But rolling a patch across thousands of endpoints in under twenty-four hours, with line-of-business apps that mandate specific Office builds, is operationally unrealistic. The patch arrives in days, not hours — and the exploitation window is now shorter than the deployment window.

That’s where compensating controls become non-negotiable.

ASR (Attack Surface Reduction) rules in Microsoft Defender block Office applications from spawning child processes and from launching executable content. Enabled in block mode, they neutralise most of the attack chain even before the patch lands.

Protected View, enabled by default in Office, opens documents from the internet in a sandbox. CVE-2026-21509 does not bypass Protected View: the document must be in edit mode for the exploit to fire. Teaching users not to click « Enable Editing » on unverified documents adds a real layer of defence.

The kill bit for Shell.Explorer.1 — applied through a registry key — blocks the vulnerable COM object from instantiating inside Office. It’s a valid stopgap for organisations that can’t patch immediately, but test it first: some legitimate line-of-business applications rely on this same control.

Finally, MFA — ideally FIDO2 phishing-resistant authentication — remains the last line. Exploiting CVE-2026-21509 gives the attacker a foothold on a workstation. If authentication to cloud services and VPNs isn’t hardened, that foothold becomes domain-wide access.

Verdict

If you run a Microsoft 365 Apps fleet with automatic updates turned on and ASR rules in block mode, CVE-2026-21509 is a managed incident: apply the patch, audit the logs, move on.

If you run a mixed fleet with Office 2016 or 2019, you have a problem. Those versions reached end-of-life in October 2025, the patch is discretionary, and the next Office zero-day will arrive faster than your next migration cycle. The cost of maintaining unsupported Office is now higher than the cost of migrating to Microsoft 365 Apps: calculate the financial risk of a compromise — ransom, business interruption, regulatory notification — and compare it to your upgrade budget. The answer will govern itself.

If you’re a fintech or any financial-sector company, add one rule to your incident-response playbook right now: the moment an Office zero-day is announced, enable ASR rules in block mode, disable Shell.Explorer.1 via registry, and broadcast a firm instruction to all staff — do not open external documents without verification. The next CVE-2026-XXXXX is weeks away. The reaction window will be the same: under twenty-four hours.

References

• Microsoft Security Response Center — CVE-2026-21509
• Acronis TRU — MSP Cybersecurity News Digest, February 9, 2026
• The Hacker News — Microsoft Issues Emergency Patch for Actively Exploited Office Zero-Day
• The Hacker News — APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks
• Orca Security — CVE-2026-21509: Microsoft Office Zero-Day Active Exploit
• CISA — Known Exploited Vulnerabilities Catalog
• Trellix — APT28 Stealthy Campaign Leveraging CVE-2026-21509
• Zscaler ThreatLabz — Operation Neusploit