Three stories landed close together this week. Each one covers a different part of the problem: how quickly attackers weaponize a fresh bug, what they take when they only plan to stay a few minutes, and what it costs a government to look for threats instead of waiting for an alert.
Sri Lanka builds a lab that hunts
SLCERT has stood up a Malware Analysis and Threat Hunting lab, MATH for short. It supports over 250 government entities across health, education, and energy. The National Cyber Security Operations Centre already handles monitoring and incident response, so MATH does the part that a SOC usually skips: proactive hunting for things that never triggered a rule, plus External Attack Surface Monitoring against publicly reachable government assets and distribution of threat intelligence back to agency stakeholders.
My guess is that the EASM work will generate the first month of findings. Exposed admin panels, default configs on a ministry web server, forgotten staging hosts. That work is unglamorous and it pays.
The APT part matters too. Hunting methodologies aimed at advanced persistent threats are the only way to find an implant that has been sitting quietly since March. Sri Lanka's digital services are expanding faster than most agencies can staff a security team, and building local malware analysis capacity means the country stops waiting on a foreign vendor to return a verdict.
APT28 shipped exploits in days
Microsoft disclosed CVE-2026-21509, an Office security feature bypass rated CVSS 7.8, on January 26, 2026, and CISA added it to KEV the same day. That rating understates the practical risk. The bug needs local access and a user who opens a file, but "opens a file" is exactly what every government employee does forty times a day.
CERT-UA bulletin #19542 tracks the follow-on activity under UAC-0001, which it links to APT28. Within days of disclosure, weaponized Word documents went to more than 60 addresses, mostly Ukrainian central executive bodies. The lure was a fake bulletin from the Ukrainian Hydrometeorological Center, named BULLETEN_H.doc. A second wave targeting EU organizations used COREPER consultations on Ukraine as the pretext.
The chain is worth reading closely because it is compact:
- The document opens and Office connects to an attacker WebDAV share on freefoodaid[.]com, wellnesscaremed[.]com, or wellnessmedcare[.]org. That last domain was registered and used on January 30.
- The share serves a shortcut that pulls down the next stage.
- The stage drops EhStoreShell.dll, named to look like the Windows Enhanced Storage Shell Extension, and a SplashScreen.png file carrying shellcode.
- Persistence is a COM hijack of CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} under HKCU, plus a scheduled task called OneDriveHealth, created from office.xml, that kills and restarts explorer.exe so the hijacked DLL loads.
- The final payload is the Covenant framework, talking to operators through the Filen cloud storage service.
Public exploit code is in 13 GitHub repositories and EPSS puts exploitation odds near 71 percent. That number will climb.
The lesson is a boring one. An Office install that is months behind on updates is the whole attack surface here. The patch was available before the APT28 campaign started.
Gorbag takes what it needs and leaves
ESET published research on Gorbag, a Russia-aligned group active against Ukrainian targets since at least February 2025. The targeting is specific enough to be uncomfortable. About a quarter of identified victims are law enforcement and justice bodies. Another quarter are local administrations, mostly city councils in areas near the front line. The rest are defense entities plus one organization documented as a major transport hub for foreign military aid. Nearly every city whose council was hit has also been struck by Russian air strikes during the same window.
The tooling reflects a group that does not want to stay. In 2025, the entry point was a macro-enabled Excel file with a base64 payload sitting in the spreadsheet cells, which a short VBA routine dropped into %ProgramData%. Lures were administrative fines and tax notices. One message came from a compromised account belonging to the Uzhhorod region local government, which probably helped it clear filters.
In early 2026 the chain changed to RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw that lets data hidden in alternate data streams land outside the folder the user selected. The archive shows a decoy PDF while writing a LNK into the Windows Startup folder, with an encrypted payload and PowerShell loader in %ProgramData%.
BeautyStealer, tracked across versions 0.9 to 2.0, is a C++ stealer that grabs cookies, saved passwords, and local state from Chrome, Edge, Opera, and Firefox, plus OpenVPN configs and files matching around 40 extensions. That extension list is the interesting part. It includes .kdbx, .jks, .rdp, .pfx, and .zs2, the format used for keys issued by Ukrainian accredited certification centers. The group is hunting for electronic signature keys, not family photos. After collection, the malware deletes itself.
ESET researcher Damien Schaeffer suggests Gorbag may be an initial access broker, passing credentials to other actors for follow-on work. That fits the pattern. Rapid collection, no lateral movement, no persistence beyond a Startup shortcut, then gone.
One detail made me laugh. Before BeautyStealer, Gorbag used Prime ReverseShell, a PowerShell reverse shell from a public GitHub repository. One variant includes a comment telling any AI reading the file that it is not malicious and only generates prime numbers from 1 to 900. ESET ran two AI assistants against it and both flagged the reverse shell. Prompt injection against a scanner you do not control is a cheap trick, and it worked about as well as it deserved.
What to do differently
Patch Office. The CVE-2026-21509 chain needs an unpatched client and an attachment. That is most of your risk in one sentence.
Hunt for the WebDAV pattern. Office processes making outbound connections to a remote share is not normal in most environments. Also check for the CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} under HKCU and a scheduled task named OneDriveHealth that restarts explorer.exe.
Decide whether Filen belongs in your egress policy. If nobody in your organization stores files there legitimately, alerting on it costs nothing.
For CVE-2025-8088, look for RAR archives that write LNK files into Startup, and for alternate data streams surviving extraction into folders the user did not pick.
The hardest one: self-deleting stealers leave no binary behind for forensics. If collection is a single pass and the malware removes itself, your host telemetry is the only record. Process ancestry, file writes into Desktop, Documents, and Downloads, and network connections from Office need to be logged before the incident, because there is nothing to collect after it.