Executive Summary
Since at least December 2025, a zero-day vulnerability in Adobe Reader has been under active exploitation. The attack involves the delivery of specially crafted PDF files that, when opened, execute obfuscated JavaScript to invoke privileged Acrobat APIs. This allows attackers to bypass security boundaries, exfiltrate sensitive system information, and potentially achieve remote code execution on affected workstations.
Technical analysis indicates that the campaign utilizes Russian-language lures, with content specifically tailored to targets within the Russian oil and gas industry. The use of specialized PDF exploit code (T1203) and obfuscated scripts (T1027) suggests a sophisticated actor conducting highly targeted operations rather than broad opportunistic scanning.
Organizations in the energy sector and those relying on Adobe Reader for document processing are at high risk. Until a formal patch is released by Adobe, defenders should implement strict attachment filtering and consider alternative PDF viewers to mitigate the risk of exploitation.