APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday - thehackernews.com

APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday Ravie LakshmananMar 02, 2026Vulnerability / Threat Intelligence A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerability in question is CVE-2026-21513 (CVSS score: 8.8), a high-severity security feature bypass affecting the MSHTML Framework. "Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network," Microsoft noted in its advisory for the flaw. It was fixed by the Windows maker as part of its February 2026 Patch Tuesday update. However, the tech giant also noted that the vulnerability had been exploited as a zero-day in real-world attacks, crediting the Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC), and Office Product Group Security Team, along with Google Threat Intelligence Group (GTIG), for reporting it. In a hypothetical attack scenario, a threat actor could weaponize the vulnerability by persuading a victim to open a malicious HTML file or shortcut (LNK) file delivered through a link or as an email attachment. Once the crafted file is opened, it manipulates browser and Windows Shell handling, causing the content to be executed by the operating system, Microsoft noted. This, in turn, allows the attacker to bypass security features and potentially achieve code execution. While the company has not officially shared any details about the zero-day exploitation effort, Akamai said it identified a malicious artifact that was uploaded to VirusTotal on January 30, 2026, and is associated with infrastructure linked to APT28. It's worth noting that the sample was flagged by the Computer Emergency Response Team of Ukraine (CERT-UA) early last month in connection with APT28's attacks exploiting another security flaw in Microsoft Office (CVE-2026-21509, CVSS score: 7.8). The web infrastructure company said CVE-2026-21513 is rooted in the logic within "ieframe.dll" that handles hyperlink navigation, and that it's the result of insufficient validation of the target URL, which allows attacker-controlled input to reach code paths that invoke ShellExecuteExW. This, in turn, enables execution of local or remote resources outside the intended browser security context. "This payload involves a specially crafted Windows Shortcut (LNK) that embeds an HTML file immediately after the standard LNK structure," security researcher Maor Dahan said. "The LNK file initiates communication with the domain wellnesscaremed[.]com, which is attributed to APT28 and has been in extensive use for the campaign's multistage payloads. The exploit leverages nested iframes and multiple DOM contexts to manipulate trust boundaries." Akamai noted that the technique makes it possible for an attacker to bypass Mark-of-the-Web (MotW) and Internet Explorer Enhanced Security Configuration (IE ESC), leading to a downgrade of the security context and ultimately facilitating the execution of malicious code outside of the browser sandbox via ShellExecuteExW. "While the observed campaign leverages malicious LNK files, the vulnerable code path can be triggered through any component embedding MSHTML," the company added. "Therefore, additional delivery mechanisms beyond LNK-based phishing should be expected." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  APT28, cybersecurity, Microsoft, MSHTML, patch Tuesday, Phishing, Threat Intelligence, Vulnerability, Windows, zero-day Trending News Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents and More CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack and More Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation Veeam Patches 7 Critical Backup and Replication Flaws Allowing Remote Code Execution Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration Load More ▼ Popular Resources Get the 2026 ASV Report to Benchmark Top Validation Tools Fix Security Noise by Focusing Only on Validated Exposures Guide - Discover How to Validate AI Risks With Adversarial Testing Webinar - Identify Key Attack Paths to Your Crown Jewels with CSMA