BeardShell and Covenant custom implant deployment
Malware Activity
Summary
Hide ▲
Show ▼
APT28 is deploying customized Covenant and BeardShell implants to sustain espionage against Ukrainian government and military targets, strengthening stealth and persistence. The tooling uses Icedrive and other cloud services for command-and-control, reducing reliance on traditional infrastructure. The latest builds add deterministic implant identifiers tied to host characteristics and execution changes designed to evade behavioral detection. The activity has been ongoing since April 2024, and the attackers have also used malicious DOC files exploiting CVE-2026-21509 in Microsoft Office.
Related Happenings
Gamaredon Ukraine espionage campaign targeting government, military and critical infrastructure
Campaign
H score56
First: 01.06.2026 14:00
Last: 01.06.2026 14:00
Sources 1
About this happening:
The Gamaredon espionage campaign remained active in January 2026, targeting Ukrainian government, military, and critical-infrastructure networks to steal documents and...
Gamaredon Ukraine espionage campaign targeting government, military and critical infrastructure
CampaignAbout this happening: The Gamaredon espionage campaign remained active in January 2026, targeting Ukrainian government, military, and critical-infrastructure networks to steal documents and...
APT28 Windows Shell LNK campaign targeting Ukraine and E.U. nations
Campaign
H score39
First: 28.04.2026 08:50
Last: 28.04.2026 08:50
Sources 1
About this happening:
A December 2025 APT28 campaign targeted Ukraine and E.U. nations with a malicious Windows Shortcut (LNK) chain that bypassed Microsoft Defender SmartScreen...
APT28 Windows Shell LNK campaign targeting Ukraine and E.U. nations
CampaignAbout this happening: A December 2025 APT28 campaign targeted Ukraine and E.U. nations with a malicious Windows Shortcut (LNK) chain that bypassed Microsoft Defender SmartScreen...
Betterleaks open-source secrets scanner launch as Gitleaks successor
Security Tool/Service
H score11
First: 15.03.2026 16:17
Last: 15.03.2026 16:17
Sources 1
About this happening:
The launch of Betterleaks adds an open-source secrets scanner that can inspect directories, files, and git repositories for valid secrets. It uses default or customized...
Betterleaks open-source secrets scanner launch as Gitleaks successor
Security Tool/ServiceAbout this happening: The launch of Betterleaks adds an open-source secrets scanner that can inspect directories, files, and git repositories for valid secrets. It uses default or customized...
APT28 long-term espionage campaign targeting Ukrainian military personnel
Campaign
H score32
First: 10.03.2026 12:55
Last: 10.03.2026 12:55
Sources 1
About this happening:
A sustained APT28 espionage campaign is using BEARDSHELL and COVENANT to surveil Ukrainian military personnel, extending access through cloud-based C2 and incr...
APT28 long-term espionage campaign targeting Ukrainian military personnel
CampaignAbout this happening: A sustained APT28 espionage campaign is using BEARDSHELL and COVENANT to surveil Ukrainian military personnel, extending access through cloud-based C2 and incr...
APT28 BEARDSHELL and COVENANT surveillance activity against Ukrainian military personnel
Malware Activity
H score23
First: 10.03.2026 12:55
Last: 10.03.2026 12:55
Sources 1
About this happening:
The APT28 operation has expanded into BEARDSHELL and COVENANT implants used for long-term surveillance of Ukrainian military personnel, indicating an active es...
APT28 BEARDSHELL and COVENANT surveillance activity against Ukrainian military personnel
Malware ActivityAbout this happening: The APT28 operation has expanded into BEARDSHELL and COVENANT implants used for long-term surveillance of Ukrainian military personnel, indicating an active es...
Timeline
-
10.03.2026 12:00 2 articles · 4mo ago
BeardShell and Covenant custom implant deployment
Initial DisclosureSince April 2024, APT28 began using BeardShell together with Covenant to establish persistent access against Ukrainian targets. The initial phase centered on cloud-linked command-and-control and fallback implant redundancy.
Show sources
- APT28 hackers deploy customized variant of Covenant open-source tool — www.bleepingcomputer.com — 10.03.2026 12:00
- APT28 hackers deploy customized variant of Covenant open-source tool — www.bleepingcomputer.com — 10.03.2026 12:00