Security News APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military

[Divergent]

Content source

https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html

The Russian state-sponsored hacking group tracked as APT28 has been observed using a pair of implants dubbed BEARDSHELL and COVENANT to facilitate long‑term surveillance of Ukrainian military personnel.

The two malware families have been put to use since April 2024, ESET said in a new report shared with The Hacker News.

APT28, also tracked as Blue Athena, BlueDelta, Fancy Bear, Fighting Ursa, Forest Blizzard (formerly Strontium), FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422, is a nation-state actor affiliated with Unit 26165 of the Russian Federation's military intelligence agency GRU.

APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military

APT28 deploys BEARDSHELL and COVENANT since April 2024 targeting Ukrainian military, enabling cloud-based espionage and persistent surveillance.

thehackernews.com

 

[Divergent]

Executive Summary
Analysis of the provided intelligence confirms a highly sophisticated cyberespionage campaign by APT28 (Sednit) aimed primarily at Ukrainian military infrastructure.

Confirmed Facts
Indicate the group has deployed custom C++ implants (BEARDSHELL) and heavily modified open-source post-exploitation frameworks (COVENANT) that abuse legitimate cloud storage APIs for command and control.

Assessment
Suggests this marks a return to bespoke, high-end malware development by the group, utilizing complex obfuscation techniques to maintain long-term, persistent surveillance.

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1583.006
Acquire Infrastructure: Web Services (Icedrive, Filen, Koofr).

T1059.001
Command and Scripting Interpreter: PowerShell.

T1546.015
Event Triggered Execution: Component Object Model Hijacking.

T1027
Obfuscated Files or Information (Opaque predicates).

CVE Profile
CVE-2026-21509 | NVD Score: 7.8
CISA KEV Status: Active

Telemetry

Hash (SlimAgent)
5603E99151F8803C13D48D83B8A64D071542F01B

Hash (BeardShell)
6D39F49AA11CE0574D581F10DB0F9BAE423CE3D5

Filename
eapphost.dll

Filename
tcpiphlpsvc.dll

Constraint
The code structure resembles previous Xtunnel and Xagent frameworks through shared opaque predicate obfuscation logic. This suggests continuity within the same development team, though the exact initial delivery vector for your specific environment yields.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Establish and enforce strict network policies regarding the usage of unauthorized third-party cloud storage applications (e.g., Icedrive, Filen, Koofr).

DETECT (DE) – Monitoring & Analysis

Command
Deploy SIEM alerts for unusual PowerShell execution originating from injected .NET assemblies or unexpected host processes.

Command
Query EDR for the presence of known malicious hashes, and anomalous COM object registrations.

(5603E99151F8803C13D48D83B8A64D071542F01B)

(6D39F49AA11CE0574D581F10DB0F9BAE423CE3D5)

RESPOND (RS) – Mitigation & Containment

Command
Isolate any endpoints exhibiting beaconing behavior to the identified cloud storage APIs.

Command
Quarantine the identified malicious DLLs (eapphost.dll, tcpiphlpsvc.dll) upon hash confirmation.

RECOVER (RC) – Restoration & Trust

Command
Reimage affected systems entirely; BEARDSHELL and SlimAgent establish deep persistence via COM hijacking, making simple file deletion insufficient.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Apply out-of-band Microsoft patches for CVE-2026-21509 immediately to prevent initial vector exploitation.

Command
Implement application control (e.g., Windows Defender Application Control) to prevent unsigned DLLs from loading.

Remediation - THE HOME USER TRACK (Safety Focus)

Note
Because the primary initial access vector (CVE-2026-21509) targets Microsoft Office, an optional software suite, the threat level is Theoretical/Low for users running a default Windows OS installation.

Priority 1: Safety

Command
Disconnect from the internet immediately only if you have Microsoft Office manually installed and suspect you have opened a weaponized document.

Command
Do not log into banking/email until verified clean.

Priority 2: Identity

Command
Reset passwords and MFA tokens using a known clean device (e.g., phone on 5G), as the SlimAgent module operates as a keylogger and clipboard stealer.

Priority 3: Persistence

Command
Check Scheduled Tasks, Startup Folders, and COM object registries for unauthorized modifications.

Hardening & References

Baseline
CIS Benchmarks for Microsoft Office and Windows Desktop environments.

Framework
NIST CSF 2.0 / SP 800-61r3.

References
CISA Known Exploited Vulnerabilities Catalog (CVE-2026-21509).

ESET Research
"Sednit reloaded: Back in the trenches".

Source

WeLiveSecurity (ESET Research)

The Hacker News