Loading story…
APT28 (Sednit/Fancy Bear), a Russian GRU-linked cyber-espionage group associated with Unit 26165, has been assessed by ESET to have reactivated a more advanced, custom tooling set beginning in April 2024, shifting from a period where its most sophisticated malware was less frequently observed. The activity has focused on long-term surveillance of Ukrainian targets, particularly military personnel, and includes the use of multiple implants: BEARDSHELL (a .NET-based implant used to execute PowerShell commands) and COVENANT (used alongside BEARDSHELL), as well as SLIMAGENT, which performs keylogging, screenshot capture, and clipboard collection. ESET and reporting based on its findings link SLIMAGENT to historical XAgent development, citing code and logging-format similarities consistent with an evolution of APT28’s earlier backdoor ecosystem.
ESET’s reporting indicates the operators use a dual-implant architecture to improve resilience, including leveraging legitimate cloud services for command-and-control; BEARDSHELL was described as using Icedrive as a C2 channel, and the overall approach was characterized as designed to maintain durable access for espionage operations extending through 2025 into 2026. Separate weekly threat-bulletin coverage that mentions unrelated breaches and other threat activity does not add material detail to the APT28/Sednit campaign described above and should not be treated as part of the same incident reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On March 10, 2026, ESET publicly reported that APT28 had revived an advanced in-house espionage toolkit centered on BeardShell and a heavily modified Covenant framework to target Ukraine.
In January 2026, CERT-UA reported a spearphishing campaign exploiting CVE-2026-21509 to deploy APT28's modified Covenant implant.
Researchers observed APT28 most recently abusing the Filen cloud storage service for Covenant command-and-control beginning in July 2025, after rotating among other providers.
In 2025, ESET saw APT28 using cloud drives controlled through its modified Covenant framework to maintain persistent surveillance of targets over extended periods.
In April 2024, CERT-UA found the SlimAgent implant on a Ukrainian government machine, providing an early public indicator of APT28's renewed custom-malware activity in Ukraine.
Since at least April 2024, APT28/Sednit has run a long-term cyber-espionage operation focused on Ukrainian military personnel using BeardShell, modified Covenant, and related tooling.
During its investigation of a 2024 breach in Ukraine, ESET uncovered the broader use of SlimAgent, BeardShell, and modified Covenant, linking the activity to Sednit/APT28.
ESET reported that Sednit/APT28 had been extensively customizing the open-source Covenant framework since 2023, adapting it for stealthy long-term espionage and cloud-drive-based command and control.
ESET identified artifacts and related samples dating to 2018 that targeted government entities in two European countries, supporting its assessment that SlimAgent evolved from APT28's older XAgent codebase.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcewelivesecurity.com
Open sourcedarkreading.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT28, also tracked as **Sofacy**, **Fancy Bear**, **Sednit**, and **Strontium**, conducted sustained cyber-espionage operations against political, government, telecommunications, aerospace, and Ukraine-linked targets using spear phishing, typosquatted sites, exploit delivery, and custom malware. Reporting tied the group to campaigns that deployed first-stage downloaders, backdoors, credential-dumping tools, exfiltration modules, and the **Seduploader** malware family, including a macro-enabled Word lure themed around a cybersecurity conference that executed `rundll32.exe` to install persistence and enable screenshot capture, file download, code execution, and data theft. Separate analysis also documented **Fysbis**, a Linux backdoor linked to Sofacy infrastructure, showing the group’s cross-platform capability and continued use of modular implants for covert access. Defenders and platform operators responded with both technical guidance and infrastructure disruption. The UK’s NCSC published indicators of compromise and detection guidance for APT28 malware including **X-Tunnel**, **X-Agent**, and **CompuTrace**, while Microsoft said it obtained a court order to seize seven domains used by the group and redirect them to a sinkhole after the infrastructure was used to target Ukrainian institutions as well as U.S. and EU government and think-tank networks for persistent access and exfiltration. Across the referenced reporting, APT28’s operations were characterized by curated targeting, evolving malware variants, and repeated use of attacker-controlled domains and command-and-control systems to support intelligence collection.
Aug 15, 2026
ESET reported that **Sednit**—the Russia-linked espionage group also tracked as **APT28/Fancy Bear**—has returned with renewed activity and updated tradecraft. The campaign reflects a continuation of the group's long-running intelligence collection operations, with researchers documenting refreshed malware and intrusion techniques designed to regain footholds in targeted environments and support covert data theft. The report indicates the operators are back to conducting targeted intrusions against organizations of strategic interest, relying on stealthy persistence and modular tooling to maintain access while evading detection. The findings reinforce that Sednit remains an active and capable state-aligned threat actor, and that defenders should expect ongoing spearphishing, credential theft, and post-compromise lateral movement associated with the group's espionage playbook.
Jul 12, 2026
Reporting highlighted multiple **state-sponsored espionage** operations, including a China-linked campaign attributed to **Camaro Dragon** targeting entities in **Qatar** with conflict-themed phishing lures that install the **PlugX** backdoor. The activity was observed rapidly following a new Middle East escalation, using war-related decoy documents and parallel infection chains with differing delivery methods and payloads, indicating more than one operator set involved and underscoring how quickly geopolitical events are operationalized for access and collection. Separately, **Russia’s APT28** (aka *Fancy Bear/Forest Blizzard/Sednit*) was reported using a heavily modified variant of the open-source **Covenant** post-exploitation framework alongside implants such as **BeardShell** and **SlimAgent** in long-term espionage against **Ukrainian** targets. The tradecraft described includes exploitation of `CVE-2026-21509` via malicious Microsoft Office documents and command-and-control over legitimate cloud services (e.g., *Icedrive*), consistent with stealth-focused persistence and surveillance operations against government and military-related environments.
Jun 29, 2026