HIGHApt
Verified
Europe

APT28 Compromises European Defense Contractor via Outlook Zero-Day

·Source: ANSSI / Microsoft Threat Intelligence

Updated:

Executive Summary

APT28 exploits Outlook NTLM relay zero-day to compromise a major European defense contractor. Classified project data at risk.

Analysis

APT28 used CVE-2026-15899, an Outlook zero-day that triggers NTLM credential relay via a specially crafted calendar invite — no user interaction beyond receiving the email. Targeted a Tier-1 European defense contractor working on next-generation weapons systems. Access maintained for approximately three weeks before detection.

Timeline

Discovered
Mar 1, 2026
Exploitation Detected
Mar 1, 2026
Published
Mar 14, 2026
Patch Available
Mar 14, 2026

Indicators of Compromise (1)

CVE (1)
CVE-2026-15899
NVDMITRE CVE
Source Attribution

Originally published by ANSSI / Microsoft Threat Intelligence on Mar 14, 2026. Verified by: ANSSI, Microsoft, NATO.

Related Threats

MEDIUMApt

AdaptHealth says attackers sweet-talked their way into cloud systems and stole patient data

Connor Jones reports: AdaptHealth says attackers used social engineering to breach its systems and steal sensitive patient data, including passwords associated with insurance billing. The medical equipment company disclosed the attack to the Securities and Exchange Commission (SEC) on Thursday, noting that attackers accessed internal patient management systems, document storage platforms, and exte

DataBreaches.net
MEDIUMApt

FBI Disrupts Widely Used NetNut Residential Proxy Service

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fbi-disrupts-widely-used-netnut-residential-proxy-service-image_small-6-a-32154.jpg" align=right hspace=4><b>2 Million Home Devices, Including Routers and Smart TVs, Tied to NetNut Botnet</b><br>The FBI and private-sector partners have disrupted NetNut, one of the world's biggest and most popular residential proxy networks. Google

Bank Info Security
MEDIUMApt

Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer

A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. "Armored Likho blends financially motivated campaigns targeting private individuals with targeted cyber espionage aimed at organizations," Kaspersky said in a technical analysis published today. "

The Hacker News