2+

Years Active

9

Countries Targeted

48h

Patch-to-Exploit

3

Cloud C2 Providers

The Story

ESET published a detailed technical analysis today documenting how APT28's advanced malware development team has reemerged with a modern espionage toolkit built around two complementary implants: BeardShell and a heavily modified version of Covenant.

The timeline starts in April 2024 when CERT-UA discovered SlimAgent, a keylogging and screenshot-capture tool, on a Ukrainian government machine. ESET's forensic work on that same system uncovered BeardShell running alongside it. Since then, both BeardShell and Covenant have been deployed together against Ukrainian military personnel in what ESET describes as sustained, long-term surveillance operations continuing through 2025 and into 2026.

The operational design is deliberate. BeardShell communicates through Icedrive cloud storage. Covenant uses a separate provider, cycling through pCloud (2023), Koofr (2024-2025), and most recently Filen (since July 2025). If one channel gets disrupted, the other maintains access. ESET found compromised machines that had been under continuous monitoring for more than six months through the Covenant-controlled cloud drives.

What makes this significant is the choice of tooling. Covenant is an open-source .NET post-exploitation framework whose official development stopped in April 2021. Defenders may have written it off as a dated tool. APT28 picked it up, rewrote major architectural components, added deterministic implant IDs tied to machine characteristics (replacing the original random identifiers), and implemented a custom cloud-based network protocol. They turned an abandoned open-source project into a production-grade espionage platform.

The campaign escalated in January 2026 when APT28 exploited CVE-2026-21509, a security feature bypass in Microsoft Office, within 48 hours of Microsoft's out-of-band patch. Trellix documented at least 29 distinct spear-phishing lures targeting organizations in Ukraine, Poland, Romania, Slovakia, Turkey, Greece, the UAE, and Bolivia. Primary targets were defense ministries (40%), transportation and logistics operators (35%), and diplomatic entities (25%).

ESET also traced code lineage directly back to APT28's 2010-era toolkit. BeardShell uses a rare obfuscation technique called "opaque predicate" that was previously seen only in XTunnel, the network-pivoting tool APT28 used during the 2016 Democratic National Committee hack. SlimAgent shares nearly identical keylogging logic with XAgent samples from 2014. This is not a new group using APT28's name. This is the same development team, operating with continuity across more than a decade.

The Toolkit

  • BEARDSHELL

    Custom Backdoor

    C++ implant executing PowerShell commands within a .NET runtime. Uses Icedrive cloud storage as C2 channel (private API, reverse-engineered by APT28 devs since Icedrive has no public API). Serves as fallback if Covenant infrastructure is burned. Linked to XTunnel via rare opaque predicate obfuscation.

  • COVENANT

    Modified Open-Source C2

    Heavily customized .NET post-exploitation framework (official dev ceased 2021). 90+ built-in tasks for exfil, monitoring, pivoting. Deterministic implant IDs from machine fingerprints. Cloud C2 via Filen (current), previously pCloud and Koofr. Primary espionage tool since 2023.

  • SLIMAGENT

    Espionage Module

    Keylogging, screenshot capture, clipboard collection. Outputs HTML-formatted espionage logs. Evolved from XAgent (2014-era). Six-stage data collection loop. Deployed since at least 2018, rediscovered in April 2024 incident.

The Adversary Perspective

From a red team standpoint, APT28's operational choices here are textbook and worth studying. Three things stand out.

First, the infrastructure redundancy model is elegant. Dual implants, each on a separate cloud provider, with BeardShell as a warm standby if Covenant's infrastructure gets taken down. This is the same resilience pattern we'd design for a high-value persistent engagement. The fact that they cycle cloud providers on a roughly annual basis shows active operational security management, not just set-and-forget deployment.

Second, adopting an abandoned open-source framework was a calculated bet. Defenders track known threat actor tooling. Security products signature-match against common C2 frameworks. But how many detection rules are actively maintained for a framework that stopped receiving updates in 2021? APT28 bet that Covenant had fallen off the radar. Based on ESET's findings that these operations ran undetected for over two years, that bet paid off.

Third, the 48-hour patch-to-exploit turnaround on CVE-2026-21509 tells you how fast this team operates. Microsoft pushed an out-of-band patch. Within two days, APT28 had reverse-engineered the fix, developed a working exploit, embedded it in crafted RTF files, and launched spear-phishing campaigns across nine countries. If your organization takes longer than 48 hours to begin deploying a critical Microsoft Office patch, you are already behind this adversary.

Here is the attack chain as reconstructed from ESET, Trellix, and CERT-UA reporting:

Figure 01

  1. STEP 01

    Spear-Phishing Delivery

    Targeted emails with malicious DOC/RTF attachments. Lures crafted in local languages (Ukrainian, Romanian, Slovak). Topics align with defense and diplomatic themes to maximize open rates among military and government targets.
  2. STEP 02 // CRITICAL

    CVE-2026-21509 Exploitation

    Office security feature bypass triggered by opening the crafted document. Server-side evasion: malicious DLL only served when requests match the target's geographic region and correct User-Agent header.
  3. STEP 03 // CRITICAL

    Dual Implant Deployment

    Dropper delivers BeardShell (Icedrive C2) and Covenant Grunt (Filen C2) simultaneously. Deterministic IDs assigned based on machine fingerprints for persistent tracking across reboots and reimaging.
  4. STEP 04

    SlimAgent Espionage Module

    Keylogger, screenshot capture, and clipboard harvester deployed as secondary collection tool. Outputs HTML-formatted logs. Targets email credentials and sensitive communications.
  5. STEP 05

    Cloud-Based Exfiltration

    Collected data exfiltrated through legitimate cloud storage APIs (Icedrive, Filen). Traffic blends with normal cloud storage usage. Commands delivered and results retrieved via cloud file operations.
  6. STEP 06 // CRITICAL

    Long-Term Persistent Access

    Targets monitored for 6+ months. Infrastructure rotated across cloud providers annually. BeardShell serves as hot standby if Covenant is disrupted. Developers patch BeardShell within hours when Icedrive API changes break comms.

Key Indicators & Detection Guidance

  • Threat Actor: APT28 / Sednit / Fancy Bear / UAC-0001 / GRU Unit 26165
  • Attribution: ESET (high confidence), CERT-UA, Trellix, Zscaler ThreatLabz
  • Implants: BEARDSHELL, COVENANT (modified), SLIMAGENT
  • C2 Channels: Icedrive, Filen (current), pCloud (historical), Koofr (historical)
  • Exploited CVE: CVE-2026-21509 (Microsoft Office SFB, CVSS 7.8)
  • Obfuscation: Opaque predicate technique (shared with XTunnel/DNC hack tooling)
  • Targets: Ukrainian military, defense ministries, diplomatic entities (9 countries)
  • Detection: Monitor for anomalous Icedrive/Filen API calls from endpoints, PowerShell execution within .NET runtime contexts, HTML-formatted keylog artifacts

Defensive Takeaways

  1. 1

    Patch CVE-2026-21509 Immediately If You Haven't Already

    This Office vulnerability was patched out-of-band in January and then included in the February Patch Tuesday cycle. APT28 had a working exploit within 48 hours of patch release. If you are not yet patched, you are vulnerable to an active campaign that has already compromised targets across nine countries. Prioritize this across all endpoints running Microsoft Office.

  2. 2

    Monitor Cloud Storage API Traffic from Endpoints

    APT28 is using legitimate cloud storage services (Icedrive, Filen, pCloud, Koofr) as C2 channels. This traffic blends with normal user activity. If your organization does not use these specific cloud storage providers, any endpoint traffic to their API domains should be flagged and investigated. If you do use them, baseline normal usage patterns and alert on anomalies, especially from servers or workstations that shouldn't be syncing files.

  3. 3

    Hunt for PowerShell Execution Within .NET Runtime Contexts

    BeardShell operates by executing PowerShell commands inside a .NET runtime environment, which can evade traditional PowerShell logging and AMSI-based detections. Review your EDR telemetry for .NET assemblies spawning PowerShell processes, particularly those loading from non-standard paths. Script block logging alone may not catch this pattern. Ensure your detection stack covers .NET-hosted PowerShell execution.

  4. 4

    Don't Ignore Open-Source C2 Frameworks Just Because Development Stopped

    APT28's success with Covenant proves that abandoned tools don't stop being dangerous. Review your detection rules for coverage against Covenant, Sliver, Mythic, and other open-source C2 frameworks regardless of their maintenance status. If your SIEM or EDR only signatures against actively maintained versions, you may miss the customized variants that nation-state actors produce. Focus detections on behavioral indicators (network patterns, task execution sequences) rather than static signatures.

  5. 5

    Implement Rapid Patch Deployment for Office/Browser Zero-Days

    The 48-hour weaponization window on CVE-2026-21509 is not an anomaly. It is the new baseline for nation-state exploitation timelines. If your patch cycle for critical Office and browser vulnerabilities exceeds 72 hours from release, you are operating outside the defensive window. Evaluate emergency patching workflows, pre-staged deployment groups, and automated deployment for critical-severity CVEs affecting Office, browsers, and VPN appliances.