Attackers are using a Windows bug that Microsoft fixed in February 2026 to break into organizations in Russia. The flaw, CVE-2026-21513, sits in MSHTML, the old HTML engine that Windows still ships for apps such as Office. Any PC that missed the February update remains open to this trick.
The cyber intelligence group at PT ESC, the security center of Positive Technologies, described the campaign in a post on its ESCalator Telegram channel on November 9. The researchers said they rebuilt the full chain, which ends with the delivery of a JScript backdoor.
A fake order in a Word file
The attack starts with a DOCX file posing as an internal company order. Its Russian file name reads “2026 Order of 08.10.2026 25-118ap”. Orders like this are routine paperwork in Russian offices, so staff have a reason to open one.
The document itself looks harmless. Instead of carrying malware, it tells Word where to fetch the next piece.
How the attack chain works
PT ESC listed these steps:
- The DOCX stores the address of a second document in an internal file called word/_rels/webSettings.xml.rels. That link points to the domain cloudpostmail.net.
- Word treats the link as an external frame. It contacts the server and downloads a file with a .doc extension. Its content is in fact an RTF document.
- The RTF file holds two embedded OLE objects of the Shell.Explorer.1 component (CLSID EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B).
- Both objects contain links to a remote Windows shortcut named UKuFuXj.lNk. One of the addresses is \\cloudpostmail.net@ssl\xcbuvhjg\UKuFuXj.lNk.
- The @ssl marker makes Windows fetch the shortcut over WebDAV using HTTPS. WebDAV lets Windows open files on a web server as if they sat on a network drive.
This matches the delivery route Microsoft describes for the bug. In its security advisory for CVE-2026-21513, the company says an attacker must convince a user to open a malicious HTML file or shortcut (.lnk) file. That file can arrive through a link, an email attachment or a download.
What the flaw lets attackers do
Microsoft rates CVE-2026-21513 as a security feature bypass with a CVSS score of 8.8 and “Important” severity. The crafted file manipulates how the browser and the Windows Shell handle content. As a result, the operating system runs the content.
The feature it defeats is the warning prompt Windows shows before running a file. Microsoft says this can let an attacker “potentially achieve code execution.” The attack needs no privileges, but the victim must open the file.
Microsoft marked the flaw as both publicly disclosed and exploited when it shipped the fix on February 10, 2026. It credited its own threat intelligence and Office security teams, plus the Google Threat Intelligence Group, for reporting it.
Technical details for defenders
Akamai researcher Maor Dahan published an analysis of the patch and an in-the-wild exploit on February 20. He traced the bug to hyperlink handling code in ieframe.dll. That code did not check target addresses well enough. Attacker input could then reach a Windows function called ShellExecuteExW, which runs files outside the browser’s security limits.
The sample Akamai studied was a Windows shortcut with an HTML file hidden right after the normal LNK data. It used nested iframes to lower its security context. This let it skip Mark of the Web, the tag Windows puts on downloaded files, and Internet Explorer Enhanced Security Configuration.
Microsoft’s fix adds stricter checks. Links using file, http and https now stay inside the browser context instead of going straight to ShellExecuteExW. Akamai also warned that any program embedding MSHTML can reach the vulnerable code, not just shortcut files.
Timeline of CVE-2026-21513
| Date | Event |
|---|---|
| January 30, 2026 | An exploit sample is first uploaded to VirusTotal, according to Akamai, which tied it to APT28 infrastructure. |
| February 10, 2026 | Microsoft patches the flaw and flags it as exploited. CISA adds it to its Known Exploited Vulnerabilities catalog the same day. |
| February 20, 2026 | Akamai publishes its root-cause analysis of the bug. |
| March 3, 2026 | Deadline for US federal agencies to fix the flaw under CISA rules. |
| November 9, 2026 | PT ESC reports the flaw in attacks on Russian organizations. |
Akamai described APT28 as a Russian state-sponsored group. The Hacker News reported that Ukraine’s CERT-UA had flagged the same sample in early February. It linked the sample to APT28 attacks that abused a separate Office flaw, CVE-2026-21509.
The CISA catalog entry lists the bug as a Microsoft MSHTML Framework protection mechanism failure. CISA marks its use in ransomware campaigns as unknown.
What changes for you
The key point is simple. This is not a new zero-day. It is a nine-month-old bug that still works wherever updates lag behind. Akamai says it affects all Windows versions, and Microsoft’s update list covers Windows 10, Windows 11 and Windows Server.
Check that your PC has the fix
Press Windows+R, type winver and press Enter. Then compare your build with the February 2026 builds below. A higher build number also includes the fix, because Windows cumulative updates carry earlier security patches.
| Windows version | February 2026 update | Patched build |
|---|---|---|
| Windows 11 24H2 | KB5077181 | 10.0.26100.7840 |
| Windows Server 2025 | KB5075899 | 10.0.26100.32370 |
| Windows 10 1607 and Windows Server 2016 | KB5075999 | 10.0.14393.8868 |
Other versions have their own update numbers on Microsoft’s advisory page. If your build is lower, run Windows Update now.
Steps for IT and security teams
- Confirm that every Windows machine, including servers, has the February 2026 update or a later one.
- Search proxy and DNS logs for cloudpostmail.net, the domain PT ESC found in this campaign.
- Block or watch wellnesscaremed[.]com, the domain Akamai tied to the earlier APT28 sample.
- Look for Office documents that load external frames, and for .lnk files fetched over WebDAV.
- Akamai suggests watching for MITRE ATT&CK techniques T1204.001 (malicious link) and T1566.001 (phishing attachment).
Keep in mind that a patch closes the door but does not clean a machine. A PC that opened the lure before updating may already run the backdoor, so it needs its own check.
What remains unclear
PT ESC did not say, in the part of its report we could verify, how many organizations were hit. It also did not name a group behind the campaign. The Russian targets stand out, since Akamai linked the earlier sample to a Russian state-backed group.
It is also unknown whether other attackers now reuse the same exploit. Akamai’s warning about other MSHTML entry points suggests defenders should not focus only on Word files and shortcuts.
