APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military

This article covers APT28 (Fancy Bear/Sednit), a Russian GRU-affiliated threat actor, using two malware implants—BEARDSHELL and COVENANT—to conduct long-term surveillance of Ukrainian military personnel since April 2024.

• •BEARDSHELL is a backdoor that executes PowerShell commands and uses the Icedrive cloud storage service for C2 communication
• •COVENANT is a heavily modified open-source .NET post-exploitation framework that has abused pCloud, Koofr, and now Filen for C2
• •SLIMAGENT, a third implant tracing back to the 2010s XAgent malware, logs keystrokes, captures screenshots, and collects clipboard data
• •BEARDSHELL shares an opaque predicate obfuscation technique with XTunnel, a tool used in the 2016 DNC hack, linking it to APT28's custom arsenal
• •