All news
threat actor activity

Precursor Intelligence

Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report

eCrime breakout time drops to 29 minutes and GenAI prompt injection hits 90+ orgs as APT28 scales LLM-powered malware.

29 September 2026
Fancy BearAPT28CrowdStrikeLLM malwareGenAI prompt injectioneCrime
Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report

At a glance

1 CVE1 actor

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2026-215097.870.8%ExploitedAvailable74 · High

Threat actors

NameTypeOriginMotivation
APT28aptRussia (GRU Unit 26165)espionage

Malware & tooling

GonePostalSlimAgentLameHugBeardShellPixyNetLoader

Vulnerability details

CVE CVSS EPSS KEV PoC PRS risk
CVE-2026-21509 7.8 70.8% ✅ listed available 74.45 (High)

Fancy Bear's AI Surge: 89% YoY Jump in CrowdStrike 2026 Report

CrowdStrike’s 2026 Global Threat Report shows Fancy Bear (APT28) has shifted its attack profile toward AI, with AI-enabled operations up 89% year-over-year. The jump is the largest single-year increase CrowdStrike has recorded for the group since it began tracking LLM-driven payloads in 2024.

The report also flags a drop in eCrime breakout time to 29 minutes, and CrowdStrike observed GenAI prompt injection at more than 90 organizations. The CVE-2026-21509 entry (CVSS 7.8, EPSS 70.8% at the 99th percentile) is in CISA’s KEV list with a public PoC, and it’s the local security bypass in Microsoft Office that lets an attacker bypass a security feature via untrusted input.

CVE-2026-21509: The Microsoft Office Flaw

CVE-2026-21509 is a local security bypass in Microsoft Office that lets an unauthorized attacker bypass a security feature by feeding untrusted input into a security decision. The NVD description reads: “Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.”

The flaw scores CVSS 7.8 (v3.1) and sits at EPSS 70.8% in the 99th percentile, putting it in the top 1% of actively exploited vulnerabilities. CISA has added it to the Known Exploited Vulnerabilities catalog, and a public PoC is available. Precursor Intelligence rates the overall risk at 74.45 (High) on its PRS scale.

Operation Neusploit: Fancy Bear's Active Exploit

Fancy Bear is actively exploiting CVE-2026-21509 in an operation it calls Neusploit. The campaign pairs the Microsoft Office local security bypass with the PixyNetLoader malware, which Sekoia’s Amaury G. and Charles M. deployed on 16 September 2025. The loader handles the initial foothold and hands off to the rest of the chain.

The same window saw Kroll’s Dave Truman and Marc Messer document Operation Phantom Net Voxel on 5 September 2025, running BEARDSHELL, GRUNT, and SLIMAGENT. That’s the full post-exploitation stack Fancy Bear typically drops after the Office bypass lands. The three operations—Neusploit, Phantom Net Voxel, and the GONEPOSTAL Outlook backdoor from 4 September—form a single campaign wave targeting the same set of victims.

LAMEHUG: First LLM-Powered Malware

Cato Networks’s Vitaly Simonovich published an analysis on 23 July 2025 identifying LAMEHUG as the first known LLM-powered malware linked to APT28 (Fancy Bear). The malware embeds a large language model directly in the payload, allowing the implant to generate and adapt code at runtime rather than relying on static C2 logic.

Ukraine’s CERT confirmed the use in UAC-0001 cyberattacks targeting the security and defense sector (CERT-UA#16039), where LAMEHUG was deployed against Ukrainian government and military endpoints. The campaign ran from 17 July 2025, with CERT-UA first flagging the LLM-based implant in its advisory on 21 June 2025.

GONEPOSTAL: Outlook Backdoor

GONEPOSTAL is an espionage tool that provides backdoor access to Microsoft Outlook. Greg Linares first spotted it on 4 September 2025, publishing the implant via his @Laughing_Mantis handle. The tool gives Fancy Bear direct access to the Outlook client, letting it read, send, and manipulate mail without the user’s knowledge.

Lab52 flagged a structural similarity between GONEPOSTAL and Cordyceps in their 23 July 2025 analysis, suggesting the two implants share a common code lineage or were built from the same internal template. That makes GONEPOSTAL the newest addition to the group’s Outlook-focused toolkit, landing just days before the Neusploit and Phantom Net Voxel operations hit the same victim set.

Key points

  • Fancy Bear AI-enabled adversary activity surges 89% YoY in CrowdStrike 2026 Global Threat Report
  • eCrime average breakout time drops to 29 minutes
  • GenAI prompt injection confirmed at 90+ organizations
  • CVE-2026-21509 (CVSS 7.8, EPSS 70.8%, KEV) used in Operation Neusploit
  • LAMEHUG is first known LLM-powered malware linked to APT28

Further reading & sources