criticalAPT
CVE-2026-21509 South Asian Espionage Campaign (WarMachine/MALDEV01) — Breakglass Intelligence Report
InvestigatedApril 3, 2026PublishedApril 3, 2026
Threat Actors:APT28APT-04ProfileAssessment
agendadoccverataptphishingcloudflaretorlnk
TLP: WHITE Date: 2026-04-03 Analyst: GHOST (Breakglass Intelligence) Classification: APT / State-Sponsored Espionage Status: COMPLETE
Executive Summary
An India-linked threat actor operating from machine MALDEV01 under username WarMachine is exploiting CVE-2026-21509 (Microsoft Office security feature bypass, CVSS 7.8) to target Pakistani government entities. The primary target is the Sindh Integrated Emergency & Health Services (SIEHS), with production payloads hosted on a compromised Punjab Safe Cities Authority (PSCA) government server. The attack chain weaponizes RTF and OLE compound documents with embedded Shell.Explorer.1 OLE objects that fetch malicious LNK files via WebDAV, bypassing Microsoft Office OLE security mitigations.
Developer artifacts reveal English-India locale (0x4009/0x4C09), WPS Office authoring environment, and a dedicated malware development workstation -- consistent with India-linked APT groups (SideWinder, Confucius, or Patchwork/Dropping Elephant). Test samples uploaded to MalwareBazaar contain an internal WebDAV server IP (192.168.171.236) with a "tets.LnK" typo, revealing hasty OPSEC.
A separate cluster of CVE-2026-21509 exploit documents (design.docx) shows Chinese-language metadata (creator "qb.li", last modified by Chinese characters, KSO locale 2052), suggesting either a shared exploit builder tool or independent Chinese-speaking adoption of the technique.
This campaign is distinct from APT28/Operation Neusploit targeting Eastern Europe, representing the first documented South Asian state-sponsored use of CVE-2026-21509.
Key Findings
- CVE-2026-21509 exploit documents targeting Pakistani government (SIEHS emergency services, PSCA law enforcement)
- Developer machine MALDEV01 ("Malware Development 01") and username WarMachine embedded in OLE metadata
- English-India locale (0x4009 in OLE, deflang19465 in RTF) across all samples in the India cluster
- WPS Office 12.2.0.23196 used as authoring tool (common in South Asian APT toolchains)
- Production payload: ClickOnce .application hosted on compromised sbis.psca.gop.pk (Government of Punjab, Pakistan)
- Test payload: WebDAV LNK fetch from 192.168.171.236 (internal dev network) with "tets" typo
- Second cluster (design.docx): Chinese-language metadata, WebBrowser ActiveX CLSID variant, WPS Cloud userId 704171050
- Shared WPS UUID (F1E327BC-269C-435d-A152-05C5408002CA) across both clusters -- may indicate shared tool or pirated WPS install
What Was Found vs. What Was Known
| Aspect | Prior Reporting | Our Findings |
|---|---|---|
| CVE-2026-21509 Users | APT28 (Russia) only | India-linked APT + possibly Chinese-speaking actor |
| Target Geography | Ukraine, Czech Republic, Poland, Romania | Pakistan (SIEHS, PSCA government entities) |
| Attribution | APT28/Fancy Bear | WarMachine/MALDEV01 (India-linked, MEDIUM-HIGH confidence) |
| Developer Artifacts | None for South Asian use | MALDEV01, WarMachine, MALDE, WPS Office build, India locale |
| Compromised Infra | freefoodaid.com, wellnesscaremed.com | sbis.psca.gop.pk (Pakistan gov) |
| Test Infrastructure | None reported | 192.168.171.236 internal WebDAV + "tets" typo |
| Chinese Operator | Not reported | design.docx with qb.li / userId 704171050 |
Attack Chain
Spear-phishing email (themed around SIEHS / emergency services)
|
v
Weaponized Document (3 formats observed)
|-- OLE Compound (.doc): Shell.Explorer.1 CLSID embedded directly
|-- RTF (.doc): objocx/objemb with hex-encoded OLE containing Shell.Explorer.1
|-- DOCX (.docx): ActiveX WebBrowser control {8856F961-340A-11D0-A96B-00C04FD705A2}
|
v
CVE-2026-21509 bypass -- OLE object instantiation despite mitigations
|
v
Navigate() / WebBrowser call to fetch remote resource
|-- Production: hxxps://sbis.psca.gop.pk/css/PDF-READER/PDF%20Viewer.application
|-- Test/Dev: file://192.168.171.236@ssl/te/tets.LnK?init=1
|
v
LNK / ClickOnce application auto-executed
|
v
Payload deployment (not recovered -- PSCA server offline)
Infrastructure Analysis
Compromised Government Infrastructure
| Asset | Organization | IP | Status |
|---|---|---|---|
| sbis.psca.gop.pk | Punjab Safe Cities Authority, Govt of Punjab, Pakistan | 103.119.125.125 | DOWN |
Suspected Related Infrastructure
| Domain | Registrar | Created | NS | Status |
|---|---|---|---|---|
| wildishadventure.com | Namecheap | 2025-08-08 | odin/zariyah.ns.cloudflare.com | DOWN (521) |
Developer Test Infrastructure
| IP | Purpose | Evidence |
|---|---|---|
| 192.168.171.236 | Internal WebDAV server for exploit testing | Embedded in cori.doc and c9.doc |
Malware Analysis
Sample Cluster 1: India-Linked (WarMachine/MALDEV01)
| Hash (SHA256) | Filename | Type | Size | First Seen |
|---|---|---|---|---|
| 8e53683133e7e1ddd1d8728b6ba8b9b80ec40f6772422c8adc8002bafe553f7b | SIEHS Document.doc | OLE/DOC | 329,216 | 2026-03-11 |
| 520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206 | cori.doc | RTF | 16,816 | 2026-03-27 |
| b68e729104d051eaf3d118f9fd9c3fde81255f2b14f349a9ce421423407e5a77 | c9.doc | RTF | 16,889 | 2026-04-01 |
Sample Cluster 2: Chinese-Language Operator
| Hash (SHA256) | Filename | Type | Size | First Seen |
|---|---|---|---|---|
| 0ed6dba3092b7e546c0ee9c6fa7ed1cf9f4c20ef28e6d96f9c7e2a19c20b6a6d | design.docx | DOCX | 31,502 | 2026-03-31 |
Developer Fingerprints (Cluster 1 - WarMachine)
| Artifact | Value |
|---|---|
| Machine Name | MALDEV01 |
| Username | WarMachine / WarMac |
| Author | MALDE |
| Application | WPS Office 12.2.0.23196 |
| WPS UUID | F1E327BC-269C-435d-A152-05C5408002CA |
| Locale (OLE) | 16393 / 0x4009 (English-India) |
| Locale (RTF) | 19465 / 0x4C09 (English-India) |
| Created | 2026-02-12 06:17:00 UTC |
| Last Modified | 2026-02-18 12:16:56 UTC |
Developer Fingerprints (Cluster 2 - Chinese Operator)
| Artifact | Value |
|---|---|
| Creator | qb.li |
| Last Modified By | 遂愿 (Chinese: "as one wishes") |
| KSO Locale | 2052 (Chinese Simplified) |
| WPS Cloud userId | 704171050 |
| WPS Cloud hdid | 4118fa5d982d0271c78892158f470f4c |
| Application | WPS Office 12.1.0.24657 |
| Template Created | 2022-08-31 |
CVE-2026-21509 Exploit Mechanism
- Shell.Explorer.1 CLSID: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}
- WebBrowser CLSID: {8856F961-340A-11D0-A96B-00C04FD705A2}
- RTF obfuscation: objocx/objemb with interleaved comment groups
- DOCX variant: Standard OOXML ActiveX embedding with persistStorage
Threat Actor Profile
Attribution Assessment
- Confidence: MEDIUM-HIGH (India-linked APT)
- Country: India (HIGH confidence)
- Evidence: English-India locale, WPS Office, MALDEV01 machine name, Pakistan gov targeting, PSCA compromise, WebDAV+LNK chain matching SideWinder/Confucius TTPs
- Possible Groups: SideWinder (T-APT-04), Confucius (APT-Q-40), Patchwork/Dropping Elephant
- Motivation: Espionage (intelligence on Pakistani emergency services / law enforcement)
OPSEC Failures
- MALDEV01 machine name in metadata
- WarMachine username not sanitized
- MALDE author field not cleared
- English-India locale not scrubbed
- Internal test IP (192.168.171.236) in released samples
- WPS Office build fingerprint with unique UUID
- "tets" typo in test LNK path
- WPS Cloud credentials in Cluster 2 (userId 704171050)
- RTF comment "fdjgbdjfbgjkdbfg" fingerprints the builder
Victim Analysis
| Organization | Sector | Country | Evidence | Confidence |
|---|---|---|---|---|
| SIEHS | Emergency Services / Government | Pakistan | Filename "SIEHS Document.doc" | HIGH |
| PSCA | Law Enforcement / Government | Pakistan | Compromised for payload hosting | MEDIUM |
MITRE ATT&CK Mapping
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Spearphishing Attachment | T1566.001 |
| Execution | Exploitation for Client Execution | T1203 |
| Execution | User Execution: Malicious File | T1204.002 |
| Defense Evasion | Obfuscated Files | T1027 |
| Defense Evasion | Exploitation for Defense Evasion | T1211 |
| C2 | Ingress Tool Transfer | T1105 |
| Resource Dev | Compromise Infrastructure | T1584.004 |
| Resource Dev | Develop Capabilities: Malware | T1587.001 |
IOC Summary
Network Indicators
hxxps://sbis[.]psca[.]gop[.]pk/css/PDF-READER/PDF%20Viewer.application
file://192[.]168[.]171[.]236@ssl/te/tets.LnK?init=1
wildishadventure[.]com
103[.]119[.]125[.]125
File Indicators
8e53683133e7e1ddd1d8728b6ba8b9b80ec40f6772422c8adc8002bafe553f7b SIEHS Document.doc
520270adf2f2f69021713dfaf5c961d88ba8b06a54d85c68b73bc590ef0ef206 cori.doc
b68e729104d051eaf3d118f9fd9c3fde81255f2b14f349a9ce421423407e5a77 c9.doc
0ed6dba3092b7e546c0ee9c6fa7ed1cf9f4c20ef28e6d96f9c7e2a19c20b6a6d design.docx
Behavioral Indicators
CLSID: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} (Shell.Explorer.1)
CLSID: {8856F961-340A-11D0-A96B-00C04FD705A2} (WebBrowser)
deflang19465 (English-India RTF locale)
OLE Author: MALDE
OLE Machine: MALDEV01
OLE User: WarMachine
WPS UUID: F1E327BC-269C-435d-A152-05C5408002CA
RTF comment: fdjgbdjfbgjkdbfg
YARA Rules
See yara_rules/cve_2026_21509_south_asia.yar (4 rules)
Suricata Rules
See suricata_rules.rules (SIDs 9000100-9000103)
Recommended Actions
Immediate (24-48 hours)
- Block sbis.psca.gop.pk/css/PDF-READER/ at web proxy
- Deploy YARA rules for Shell.Explorer.1/WebBrowser CLSIDs with India locale markers
- Alert on WebDAV connections from Office processes to external IPs
- Notify Pakistan CERT about compromised PSCA infrastructure
- Notify SIEHS about active targeting
Short-term (1-2 weeks)
- Patch Office for CVE-2026-21509 (KB5032990+)
- Hunt for ClickOnce .application files via Office
- Monitor MalwareBazaar for new CVE-2026-21509 samples from reporter smica83
Medium-term (1-3 months)
- Block Shell.Explorer.1 and WebBrowser CLSIDs via Office kill-bit
- Monitor wildishadventure.com for reactivation
- Track WPS Cloud userId 704171050