Threat Brief: February 5, 2026 - APT28 Goes Live, Supply Chains Under Fire

Patrick Duggan
Feb 5
3 min read

Updated: Aug 11

# Threat Brief: February 5, 2026 - APT28 Goes Live, Supply Chains Under Fire

**TL;DR:** APT28 is actively exploiting a new Microsoft Office vulnerability (CVE-2026-21509) targeting European military. Notepad++ supply chain compromised by Chinese actors. New ransomware syndicate hit 71 organizations in 48 hours. Russian wipers targeting Polish infrastructure. Patch now or pay later.

Priority 1: APT28 Operation Neusploit

**Status:** ACTIVE EXPLOITATION

Russia's APT28 (Fancy Bear) weaponized CVE-2026-21509 within 24 hours of disclosure.

**Targets:**

- European military and government

- Maritime and transport organizations

- Ukraine, Slovakia, Romania, Poland, Slovenia, Turkey, Greece, UAE

**Kill Chain:**

1. Malicious RTF/LNK files delivered via spear-phishing

2. CVE-2026-21509 bypass triggers shellcode loader

3. Steganographic payload hidden in SplashScreen.png

4. BEARDSHELL implant establishes persistence

5. NotDoor backdoor hijacks Outlook for C2

**Indicators:**

- `[email protected]` - threat actor email

- BEARDSHELL - C++ implant

- NotDoor/GONEPOSTAL - Outlook VBA backdoor

- MiniDoor - email stealer

**Action:** Patch Microsoft Office immediately. Block IOCs at email gateway.

Priority 2: Supply Chain Attacks

Notepad++ Compromised (Lotus Blossom)

China-linked Lotus Blossom compromised Notepad++ distribution infrastructure. Users who downloaded the editor received the Chrysalis backdoor.

**Action:** Verify Notepad++ installation hashes. Check for unauthorized network connections.

eScan Antivirus Compromised

MicroWorld Technologies suffered supply-chain attack. Malicious updates pushed through legitimate eScan updater.

**Action:** If running eScan, isolate systems and investigate.

Priority 3: New Ransomware Threat

0APT RaaS Syndicate

Emerged January 28, 2026. Compromised 71 organizations within 48 hours.

**TTPs:**

- AES-256/Salsa20 encryption

- Double extortion (encrypt + leak)

- Rapid deployment capability

**Action:** Verify backup integrity. Review network segmentation.

Priority 4: Wiper Attacks on Poland

Static Tundra Campaign

Russia-linked group targeting Polish energy and manufacturing sectors.

**Attack Path:**

1. Initial access via FortiGate SSL VPN

2. Reconnaissance and lateral movement

3. DynoWiper and LazyWiper deployment

4. Firmware damage and file corruption

**Action:** Patch Fortinet devices (CVE-2026-24858). Implement network monitoring.

Critical Vulnerabilities (Patch Now)

|-----|---------|------|--------|

| CVE-2026-21509 | Microsoft Office | 7.8 | **APT28 ACTIVE** |

| CVE-2026-24858 | Fortinet FortiCloud | 9.4 | **ACTIVE EXPLOITATION** |

Emerging Threats

RedKitten Campaign

LLM-assisted malware development targeting Iranian activists and NGOs.

- Password-protected Excel lures

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

- SloppyMIO implant with Telegram C2

- First confirmed AI-assisted threat campaign in 2026

Clawdbot Exposure

900+ exposed Clawdbot AI agent instances identified. Enables credential theft and RCE through misconfigured deployments.

IOCs Added to Index

19 new indicators indexed to DugganUSA threat intel:

- 5 CVEs (actively exploited)

- 7 malware families

- 2 threat actor emails

- 4 threat actor profiles

- 1 campaign tracker

Search at: `https://analytics.dugganusa.com/api/v1/search?q=APT28&indexes=iocs`

Recommended Actions

1. **Immediate:** Patch Microsoft Office (CVE-2026-21509)

2. **Immediate:** Patch Fortinet products (CVE-2026-24858)

3. **24 Hours:** Verify Notepad++ installations

4. **24 Hours:** Review FortiGate VPN logs

5. **This Week:** Audit backup and recovery procedures

6. **This Week:** Implement email attachment sandboxing

Attribution Summary

| Actor | Nation | Current Campaign |

|-------|--------|------------------|

| APT28 | Russia | Operation Neusploit (EU military) |

| Static Tundra | Russia | Polish infrastructure wipers |

| Lotus Blossom | China | Notepad++ supply chain |

| RedKitten | Unknown | Iranian activists (LLM-assisted) |

| 0APT | Unknown | Mass ransomware deployment |

*Published by DugganUSA LLC - Minnesota-based threat intelligence.*

*Stay frosty. Patch fast. Trust nothing.*

Sources

- [Check Point Threat Intelligence Report](https://research.checkpoint.com/2026/2nd-february-threat-intelligence-report/)

- [APT28 CVE-2026-21509 Campaign - The Hacker News](https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html)

- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

- Zscaler ThreatLabz

- Polish CERT

*Her name was Renee Nicole Good.*

*His name was Alex Jeffery Pretti.*

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=threat-brief-february-5-2026-apt28-goes-live-supply-chains-under-fire