APT28 Turned a Fresh Office Bug on Ukraine Within Days, CERT-UA Says
CERT-UA says APT28 sent Office documents exploiting CVE-2026-21509 to Ukrainian government bodies and EU organizations days after Microsoft disclosed the flaw, planting a Covenant implant that talks through Filen.
Days after Microsoft disclosed an exploited Office flaw in January, Russia’s APT28 was already using it against Ukraine’s government and organizations in the EU. That’s the account in CERT-UA bulletin #19542, which tracks the group as UAC-0001. CERT-UA says booby-trapped Word documents exploiting CVE-2026-21509 went to more than 60 addresses, mostly central government bodies, disguised as mail from Ukraine’s hydrometeorological center, while other copies used EU COREPER consultations on Ukraine as the lure.
For defenders
The bug: CVE-2026-21509 is a Microsoft Office security feature bypass (CVSS 7.8, local, needs the victim to open a file). Microsoft disclosed it as exploited on Jan. 26, 2026, and CISA added it to KEV the same day. Public exploit code is reported in 13 GitHub repositories; EPSS puts exploitation odds near 71%.
Timeline, per CERT-UA: two staging domains were registered Jan. 12; one lure’s metadata shows it was created Jan. 27 at 07:43 UTC, a day after disclosure; the Ukrhydrometcenter-themed emails and the public lure surfaced Jan. 29; a third domain was registered and used on Jan. 30. Three more documents aimed at EU organizations turned up in late January.
The chain: opening the document (T1203 (Exploitation for Client Execution)) makes Office connect to an attacker WebDAV share and pull a shortcut file that downloads and runs the next stage. That drops EhStoreShell.dll, posing as Windows’ Enhanced Storage Shell Extension, and SplashScreen.png, which hides shellcode. Persistence comes from hijacking a COM class in the user’s registry (T1546.015 (Event Triggered Execution: Component Object Model Hijacking)) plus a scheduled task named OneDriveHealth (T1053.005 (Scheduled Task/Job: Scheduled Task)) that kills and restarts Explorer, so Explorer loads the DLL. The final payload is the Covenant framework, which talks to its operators through the Filen cloud storage service (T1102 (Web Service)).
Related: ExaTrack later tied the DLL here (SHA256 52b6fb40…) to a loader family it calls PixyNetLoader; see https://threatroundup.com/apt28-pixynetloader-png-steganography-exatrack/ for that research.
freefoodaid[.]com
wellnesscaremed[.]com
wellnessmedcare[.]org
159.253.120[.]2
193.187.148[.]169
23.227.202[.]14
hxxp://wellnesscaremed[.]com/venezia/d/s.d%PROGRAMDATA%\Microsoft OneDrive\setup\Cache\SplashScreen.png
%PROGRAMDATA%\USOPublic\Data\User\EhStoreShell.dll
%TMP%\Diagnostics\office.xml
HKCU\Software\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InProcServer32
Scheduled task: OneDriveHealth
Lures: BULLETEN_H.doc, Consultation_Topics_Ukraine(Final).docCERT-UA’s bulletin has the full list of file hashes, WebDAV paths and Filen addresses. It recommends applying Microsoft’s mitigations, including the registry changes, and blocking or closely monitoring Filen traffic.
What it means for you
This was a spy operation against governments, not a mass campaign. The part that matters to everyone is the speed: the attackers had working documents out within days of Microsoft announcing the bug. An Office update closes this hole, so a copy of Office that’s months behind on updates is the real risk.
Do this now
- Update Microsoft Office now and keep automatic updates on; this flaw was fixed in January.
- Be wary of Word attachments that arrive unexpectedly, even from a sender that looks official.
- Security teams: check for a scheduled task called OneDriveHealth and the COM registry key above, and search proxy and DNS logs for the three domains.
- If nobody in your organization uses Filen, block it; if some people do, alert on Filen traffic from anything other than its own app or a browser.
Source article: “Hazard Bulletin”: UAC-0001 (APT28) conducts cyberattacks against Ukraine and EU countries using the CVE-2026-21509 exploit (CERT-UA#19542) (title translated from Ukrainian)
Publisher: CERT-UA
Published: late January / early February 2026 (exact date not shown on the page; events run to Jan. 30, 2026)
URL: https://cert.gov.ua/article/6287250
Executive Summary
CERT-UA tracks this activity as UAC-0001, which it links to APT28 (also reported as Pawn Storm by Trend Micro; ExaTrack names the loader component PixyNetLoader). Within days of Microsoft’s Jan. 26, 2026 disclosure of the actively exploited Office security feature bypass CVE-2026-21509, the group sent weaponized Word documents to more than 60 addresses, mainly Ukrainian central executive bodies, impersonating the Ukrainian Hydrometeorological Center (BULLETEN_H.doc), and used EU COREPER consultations on Ukraine as the lure for documents aimed at EU organizations, three more of which surfaced in late January. Opening a document makes Office reach an attacker WebDAV share on freefoodaid[.]com, wellnesscaremed[.]com or wellnessmedcare[.]org (the last registered and used on Jan. 30), fetch a shortcut that downloads the next stage, and drop EhStoreShell.dll plus a shellcode-carrying SplashScreen.png; persistence is a COM hijack of CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} under HKCU and a OneDriveHealth scheduled task, created from office.xml, that kills and restarts explorer.exe so the hijacked DLL loads and runs the shellcode. The final payload is the Covenant framework using the Filen cloud storage service for command and control. The objective is espionage against Ukrainian and EU government targets, and the impact on an infected host is a persistent implant whose traffic hides in a legitimate encrypted cloud service. CERT-UA publishes file hashes, staging URLs, actor domains and IPs, host artifacts and the Filen address ranges but no detection rules; hunt leads, false positive expectations and indicators are detailed below.
ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Command and Control
Hunt Lead Grid
| Hunt Lead Level | Hunt Lead Name | ATT&CK | Risk of False Positives |
|---|---|---|---|
| 1 (Junior) | CERT-UA#19542 File and Host Artifact Sweep | T1204.002 (User Execution: Malicious File), T1036.005 (Masquerading: Match Legitimate Resource Name or Location) | Low. The hashes are exact samples, and EhStoreShell.dll under USOPublic or SplashScreen.png under a ProgramData “Microsoft OneDrive\setup\Cache” folder have no legitimate reason to exist. |
| 1 (Junior) | WebDAV Staging Domains and IPs | T1105 (Ingress Tool Transfer) | Low. The three domains were registered in January 2026 for this operation; the IPs could be reused by other tenants later, so weight hits by date. |
| 2 (Pro) | OneDriveHealth Task That Restarts Explorer | T1053.005 (Scheduled Task/Job: Scheduled Task), T1546.015 (Event Triggered Execution: Component Object Model Hijacking) | Low to Medium. OneDrive creates its own scheduled tasks, but not one called OneDriveHealth that imports XML from %TMP%\Diagnostics and kills explorer.exe; anchor on the task name, XML path and the taskkill pattern together. |
| 3 (Elite) | Office to WebDAV to LNK, Then Filen From Explorer | T1203 (Exploitation for Client Execution), T1102.002 (Web Service: Bidirectional Communication) | High on any one signal, since Office opens WebDAV links legitimately and some staff use Filen; only the sequence of Office reaching an external WebDAV share, an LNK download, and later Filen traffic from explorer.exe holds up. |
CERT-UA#19542 File and Host Artifact Sweep
CERT-UA publishes MD5 and SHA-256 values for every stage: the lures (BULLETEN_H.doc, Consultation_Topics_Ukraine(Final).doc and three more documents), the shortcut document.doc.LnK, a downloaded stage named s.d, EhStoreShell.dll, SplashScreen.png, the extracted shellcode, the Covenant DLL and the office.xml task definition. On disk, the implant lives at %PROGRAMDATA%\USOPublic\Data\User\EhStoreShell.dll with its image at %PROGRAMDATA%\Microsoft OneDrive\setup\Cache\SplashScreen.png, and the task definition is written to %TMP%\Diagnostics\office.xml. The detection logic is a retrospective hash match across EDR, mail gateway and file-inventory data using the appendix below, plus a file-existence and file-creation search for those three paths on every Windows host.
Sweep from Jan. 12, 2026, when the first staging domains were registered, to now; the implant is persistent, so a live file-system check matters as much as historical events. Mail gateways and sandboxes are worth searching for the lure hashes and names even where endpoints are clean, because a delivered but unopened document still tells you that you were targeted. The DLL deliberately borrows the name of a real Windows component (the genuine Enhanced Storage shell extension is EhStorShell.dll in System32), so alert on the name only outside System32 and SysWOW64, never by name alone. Any hit on the DLL, PNG or office.xml is a confirmed compromise: isolate the host, preserve the files and escalate to incident response.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Execution → T1204.002 (User Execution: Malicious File); Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location) (our mapping; the source gives no ATT&CK IDs)
Sources: CERT-UA#19542, CERT-UA, early 2026, https://cert.gov.ua/article/6287250 (source article)
WebDAV Staging Domains and IPs
When the lure is opened, Office connects over WebDAV to an attacker share and retrieves a shortcut, which then fetches the next stage over HTTP or HTTPS. CERT-UA lists the staging domains freefoodaid[.]com and wellnesscaremed[.]com (both registered Jan. 12, 2026) and wellnessmedcare[.]org (registered and used Jan. 30), the IPs 159.253.120[.]2, 193.187.148[.]169 and 23.227.202[.]14, and request paths including hxxp://freefoodaid[.]com/documents/2_2.lNk?init=, hxxp://wellnesscaremed[.]com/buch/Downloads/document.doc.LnK?init=, hxxp://wellnesscaremed[.]com/venezia/d/s.d and hxxps://wellnessmedcare[.]org/davwwwroot/cz/Downloads/document.LnK?init=, plus WebDAV-over-SSL forms such as wellnessmedcare[.]org@ssl/pol/Downloads/blank.doc. The detection logic is a search of DNS, proxy and firewall logs for the domains and IPs, and of proxy logs for any URL containing davwwwroot, a .lnk file with a “?init=” query, or a mixed-case “.LnK”/”.lNk” extension.
Use DNS resolver logs, secure web gateway logs and EDR network events from late January 2026 onward. The URL patterns are the more durable part: the actor’s mixed-case shortcut extensions and “?init=” parameter are distinctive, while the domains were burned as soon as CERT-UA published. WebDAV traffic from Office appears in proxy logs with a “Microsoft-WebDAV-MiniRedir” user agent, and an Office document reaching an external WebDAV host is uncommon in most environments, so it’s worth a standing alert. Blocking outbound WebDAV to the internet at the gateway is a sound hardening step. Any match from the January–February 2026 window means a lure was opened; check the host against the first and third leads.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Command and Control → T1105 (Ingress Tool Transfer) (our mapping; the source gives no ATT&CK IDs)
Sources: CERT-UA#19542, CERT-UA, early 2026, https://cert.gov.ua/article/6287250 (source article)
OneDriveHealth Task That Restarts Explorer
The dropper sets up two linked persistence pieces. It writes the DLL path into the default value (and a ThreadingModel value) of HKCU\Software\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InProcServer32, so the per-user registration overrides the system one, and it creates a scheduled task with schtasks.exe /Create /tn “OneDriveHealth” /XML “%TMP%\Diagnostics\office.xml” (after deleting any existing task of that name). The task runs taskkill /f /IM explorer.exe followed by start explorer, so the fresh Explorer process instantiates the hijacked class and loads EhStoreShell.dll. The detection logic is any schtasks.exe creation with /XML pointing into a user Temp folder, any task named OneDriveHealth, and any taskkill of explorer.exe followed within seconds by an Explorer start from a task or cmd.exe, raised to critical when an InProcServer32 write under HKCU for that CLSID happened shortly before.
Use EDR process creation with command lines (or Sysmon Event ID 1), Windows Security Event ID 4698 for task creation, the Task Scheduler operational log, and registry telemetry (Sysmon Event IDs 12 and 13) for HKCU\Software\Classes\CLSID. Also sweep existing task folders and every user hive, because these were created months ago. Legitimate OneDrive tasks use names like “OneDrive Standalone Update Task” and point at OneDrive’s own executable, so allowlist by the task’s action path rather than by the word OneDrive. Killing Explorer from a scheduled task is rare outside software installers, which makes the taskkill-then-restart pattern a good generic detection for this style of COM-hijack trigger. On a hit, export the task and registry key before removing them, and treat the host as compromised.
Hunt Lead Level: 2 (Pro)
ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task), T1546.015 (Event Triggered Execution: Component Object Model Hijacking) (our mapping; the source gives no ATT&CK IDs)
Sources: CERT-UA#19542, CERT-UA, early 2026, https://cert.gov.ua/article/6287250 (source article)
Office to WebDAV to LNK, Then Filen From Explorer
The full sequence on a victim is: winword.exe opens the lure and, through the CVE-2026-21509 bypass, reaches out over WebDAV to an external host; a .lnk file arrives and its target downloads and runs the dropper; the DLL and PNG land in ProgramData; the task restarts Explorer; and from then on Explorer, now hosting the Covenant implant, talks to the Filen cloud storage service. CERT-UA lists Filen’s infrastructure (*.filen.io, *.filen.net, *.filen-1.net through *.filen-6.net, *.filen.dev and a block of 146.0.41.x addresses) and recommends blocking it or monitoring it closely; Filen is a legitimate end-to-end encrypted storage provider, which is what makes it good cover. The detection logic correlates, per host, an Office process making an outbound WebDAV or SMB connection to an internet host, a .lnk written or executed within minutes, and later DNS lookups or TLS connections to Filen domains attributed to explorer.exe or another process that is not a browser or the Filen client.
Join EDR process, file and network events with DNS and proxy logs that carry process attribution, and sweep 90 days plus the January 2026 window. Where no one uses Filen, a block plus an alert on attempts is cheap and effective; where it’s in use, allowlist the signed Filen desktop app and browsers by image path and alert on everything else, especially explorer.exe, which never needs to talk to a storage provider’s API on its own. Content inspection won’t help because the traffic is end-to-end encrypted. Apply Microsoft’s CVE-2026-21509 update and the registry mitigations CERT-UA references regardless of hunt results. Any host showing the full sequence is an active espionage intrusion; isolate it and hand it to incident response.
Hunt Lead Level: 3 (Elite)
ATT&CK: Execution → T1203 (Exploitation for Client Execution); Command and Control → T1102.002 (Web Service: Bidirectional Communication) (our mapping; the source gives no ATT&CK IDs)
Sources: CERT-UA#19542, CERT-UA, early 2026, https://cert.gov.ua/article/6287250 (source article); “Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026”, ExaTrack, June 1, 2026, https://exatrack.com/publications/apt28-pixynetloader.html (additional source, same campaign and DLL; Covenant over Filen confirmed)
Hash Appendix
CERT-UA#19542 lures, stages and payloads
MD5 and SHA-256 values come from the source article; CERT-UA publishes no SHA-1 and none were retrieved from OTX AlienVault or VirusTotal for this report, except the SHA-1s for s.d (8c1dc973…) and EhStoreShell.dll (52b6fb40…), which were sourced via OTX.
MD5s
7c396677848776f9824ebe408bbba943 # BULLETEN_H.doc -> CVE-2026-21509 lure (Ukrhydrometcenter theme)
95e59536455a089ced64f5af2539a449 # Consultation_Topics_Ukraine(Final).doc -> CVE-2026-21509 lure (COREPER theme)
4727582023cd8071a6f388ea3ba2feaa # 4727582023cd8071a6f388ea3ba2feaa.doc -> lure document
d47261e52335b516a777da368208ee91 # 1291.doc -> lure document
b6a86f44d0a3fa5a5ac979d691189f2d # 1301.doc -> lure document
d8e880975ab01c745386663409a9d3aa # document.doc.LnK -> shortcut fetched over WebDAV
744bbe8d7c3d0421fa0deb582481f5ba # s.d -> downloaded dropper stage
4423b8f3456e54eb48dfbde0b4c7984b # EhStoreShell.dll -> loader DLL, %PROGRAMDATA%\USOPublic\Data\User\
418dc7365e78f79ef7dfcfbfe1bc8b0e # SplashScreen.png -> image carrying shellcode, %PROGRAMDATA%\Microsoft OneDrive\setup\Cache\
331e055e6a519d443233bd740dbfe8ee # SplashScreen_shellcode.bin -> shellcode extracted from the PNG
6f528ad405bffa4a8c2f61b1fa2172fd # covenant.dll -> Covenant implant
ee0b44346db028a621d1dec99f429823 # office.xml -> OneDriveHealth task definition, %TMP%\Diagnostics\SHA1s
(not available) # BULLETEN_H.doc -> CVE-2026-21509 lure (Ukrhydrometcenter theme)
(not available) # Consultation_Topics_Ukraine(Final).doc -> CVE-2026-21509 lure (COREPER theme)
(not available) # 4727582023cd8071a6f388ea3ba2feaa.doc -> lure document
(not available) # 1291.doc -> lure document
(not available) # 1301.doc -> lure document
(not available) # document.doc.LnK -> shortcut fetched over WebDAV
7bc3bafa39f61969a577f54bff28c0d1eff75d5c # s.d -> downloaded dropper stage (sourced via OTX)
e55cacbbff9ad573cbaddf8a59bac187bf8c78f3 # EhStoreShell.dll -> loader DLL, %PROGRAMDATA%\USOPublic\Data\User\ (sourced via OTX)
(not available) # SplashScreen.png -> image carrying shellcode, %PROGRAMDATA%\Microsoft OneDrive\setup\Cache\
(not available) # SplashScreen_shellcode.bin -> shellcode extracted from the PNG
(not available) # covenant.dll -> Covenant implant
(not available) # office.xml -> OneDriveHealth task definition, %TMP%\Diagnostics\SHA256s
c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f # BULLETEN_H.doc -> CVE-2026-21509 lure (Ukrhydrometcenter theme)
b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546 # Consultation_Topics_Ukraine(Final).doc -> CVE-2026-21509 lure (COREPER theme)
5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02 # 4727582023cd8071a6f388ea3ba2feaa.doc -> lure document
fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b # 1291.doc -> lure document
969d2776df0674a1cca0f74c2fccbc43802b4f2b62ecccecc26ed538e9565eae # 1301.doc -> lure document
b2e771cbfa0a74d0774db162d28c1eecd3a7cb384dfe97522e9baabd1c04d304 # document.doc.LnK -> shortcut fetched over WebDAV
8c1dc9732884c6078b23953b78314a8d0d8b8d9fe42e5f97a7cd09b8ace943a9 # s.d -> downloaded dropper stage
52b6fb40e7efb09c2bebe8550178e7e30009600bdedd1acae085d753761b7598 # EhStoreShell.dll -> loader DLL, %PROGRAMDATA%\USOPublic\Data\User\
c4389cc34b672c4f885547f413bf38575e6ee2b23a0ddfdd306a69c1775db6fc # SplashScreen.png -> image carrying shellcode, %PROGRAMDATA%\Microsoft OneDrive\setup\Cache\
495cf3fd22d4fc2c6c86b689b68141ac7d0130b0bb5cbc834ef59275132ee5c2 # SplashScreen_shellcode.bin -> shellcode extracted from the PNG
40c2e559992a7f595c593b419930a3f216516c3042ad86fb985348d53b6e01b9 # covenant.dll -> Covenant implant
9f4672c1374034ac4556264f0d4bf96ee242c0b5a9edaa4715b5e61fe8d55cc8 # office.xml -> OneDriveHealth task definition, %TMP%\Diagnostics\References Appendix
- “Hazard Bulletin”: UAC-0001 (APT28) conducts cyberattacks against Ukraine and EU countries using the CVE-2026-21509 exploit (CERT-UA#19542), CERT-UA, early 2026, https://cert.gov.ua/article/6287250 (source article; targets, timeline, chain, IOCs, recommendations)
- “Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026”, ExaTrack, June 1, 2026, https://exatrack.com/publications/apt28-pixynetloader.html (loader family naming; Covenant over Filen)
- CVE-2026-21509, Microsoft Security Response Center, Jan. 26, 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 (vulnerability and update)
- OTX AlienVault file indicator records for 52b6fb40… and 8c1dc973…, AlienVault, accessed Nov. 2, 2026, https://otx.alienvault.com/ (SHA-1 values marked “sourced via OTX”)
- MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/
CVE at a glance
- CVSS
- 7.8 High (v3.1)
- EPSS
- 70.8% chance of exploitation in the next 30 days (higher than 99.3% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Jan 26, 2026
- Public exploit
- Yes, reported in 13 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.