Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)
Threat Actors
Excerpt
by Robin Dost EDIT: 04.02.2026: I have YARA Rules available for detection, contact me at contact@robin-dost.de if you need them. After publishing this article, I received technical feedback regarding the root cause of CVE-2026-21509. Based on that input, I corrected several parts of the analysis. Update Notes: The vulnerability does not rely on malformed OLE objects, and WebDAV is not part of the exploit primitive. CVE-2026-21509 is caused by an allowlist gap around…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Attack Flow6 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b | Medium | Score 53/100 | First seen |
| SHA256 | b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546 | Medium | Score 53/100 | First seen |
| SHA256 | 5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02 | Medium | Score 53/100 | First seen |
| SHA256 | 969d2776df0674a1cca0f74c2fccbc43802b4f2b62ecccecc26ed538e9565eae | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-21509 | High | Score 79/100 | First seen |
| SHA256 | c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…