Executive Summary
The APT28 threat actor, also known as Fancy Bear, launched a campaign in late 2025 targeting Ukraine and EU nations using weaponized LNK files. While initial patches addressed Remote Code Execution (RCE) via CVE-2026-21510 and CVE-2026-21513, Akamai researchers discovered an incomplete fix that resulted in CVE-2026-32202.
This new zero-click vulnerability allows for authentication coercion. When Windows Explorer renders a folder containing a malicious LNK file, it attempts to extract an icon from a remote UNC path before any security trust verification occurs. This process automatically triggers an SMB connection and NTLM authentication handshake.
The impact is high as it enables the theft of Net-NTLMv2 hashes without user interaction. These hashes can be utilized in NTLM relay attacks or for offline password cracking, potentially compromising internal environments even after RCE vulnerabilities are patched.