APT28 Weaponizes Outlook Zero-Click Flaw to Steal Net-NTLMv2 Hashes From NATO Targets

Russian state-sponsored threat actor APT28 , also known as Fancy Bear or Forest Blizzard, has aggressively shifted its cyber espionage tactics to focus on zero-click vulnerabilities and edge infrastructure. Recent threat intelligence reveals that the group, publicly attributed to the GRU’s Unit 26165, has weaponized a critical Outlook flaw to silently extract Net-NTLMv2 hashes from NATO members, defense organizations, and critical infrastructure entities. The core of…

Diamond Model