Threats & Adversaries · APT / Espionage
ESET reports APT28 has used BEARDSHELL and COVENANT since April 2024 to conduct persistent surveillance of Ukrainian military personnel.
2 sources · Mar 10
The Hacker News
APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military
APT28 deploys BEARDSHELL and COVENANT since April 2024 targeting Ukrainian military, enabling cloud-based espionage and persistent surveillance.
originalBleepingComputer
APT28 hackers deploy customized variant of Covenant open-source tool
The Russian state-sponsored APT28 threat group is using a custom variant of the open-source Covenant post-exploitation framework for long-term espionage operations.
originalPart of the PlainSec briefing for 2026-03-10
Every edition of this story: APT28 conducts long-running surveillance of Ukrainian military