---
title: Russian Hackers Exploit Microsoft Office Zero-Day in Eastern Europe Attacks
description: APT28 exploits Microsoft Office zero-day to target Ukraine, Slovakia, and Romania with malware via weaponized RTF documents.
canonical_url: https://codekeeper.co/ticker/apt28-exploits-office-zero-day-in-europe
---

# Russian Hackers Exploit Microsoft Office Zero-Day in Eastern Europe Attacks

APT28 exploits Microsoft Office zero-day to target Ukraine, Slovakia, and Romania with malware via weaponized RTF documents.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Feb 3, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Russia's APT28 hacking group is actively exploiting a critical Microsoft Office zero-day vulnerability to target victims across Ukraine, Slovakia, and Romania. The attackers send weaponized RTF documents in local languages that silently install malware when opened. Zscaler researchers discovered the campaign in January 2026, with active attacks occurring just three days after Microsoft's emergency patch on January 26. The hackers deploy two types of malware: MiniDoor steals emails from Outlook, while PixyNetLoader provides remote access to compromised systems. The sophisticated operation uses geographic filtering to evade detection, only delivering payloads to targets in specific regions with correct HTTP headers. **Source:** [Cybersecurity News](https://cybersecuritynews.com/apt28-hackers-exploiting-microsoft-office-0-day/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fapt28-exploits-office-zero-day-in-europe%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[![FBI arrests Canadian in Pennsylvania linked to ShinyHunters hack, part of efforts to dismantle the group after breaching FBI data.](https://codekeeper.co/hubfs/_sized/Generated%20Blog%20Post%20Images/fbi-arrests-canadian-in-shinyhunters-hack-800.png) Cyberattacks New Arrest in the Hunt for the FBI Jobs Site Hackers Oct 12, 2026](https://codekeeper.co/ticker/fbi-arrests-canadian-in-shinyhunters-hack)

[CrowdSec Source Code Stolen in TanStack Supply Chain Attack Sep 26, 2026](https://codekeeper.co/ticker/crowdsec-supply-chain-breach-github-repositories)

[Cyberattacks UK Warns Power Companies After Cyberattack Takes Small Generator Offline Aug 25, 2026](https://codekeeper.co/ticker/uk-warns-power-firms-generator-cyberattack)

[Cyberattacks Chrome Zero-Day Exploit Spread to Four Spy Groups Within Days Sep 10, 2026](https://codekeeper.co/ticker/bluemoon-exploit-kit-targets-chrome-windows)