APT28 Exploited MSHTML Zero-Day (CVE-2026-21513) Before February Patch

Russia's APT28 (Fancy Bear) exploited CVE-2026-21513, an MSHTML zero-day rated CVSS 8.8, using malicious LNK files to bypass security controls and execute arbitrary code. The vulnerability was actively exploited before Microsoft's February 2026 Patch Tuesday, which itself addressed six actively exploited zero-days. The campaign reinforces APT28's continued focus on Western government and defense targets amid the broader Russia-Ukraine conflict.