Threats · 234 days ago

Russian GRU APT resurfaces using cloud-based espionage toolkit

Sednit (Unit 26165/GRU) resumed espionage against Ukrainian military and government targets. ESET links deployments since April 2024 of SlimAgent, BeardShell and a reworked Covenant using legitimate cloud services for C2. The paired implants enable sustained surveillance and operational resilience.

Timeline

• Mar 10 Reported by Dark Reading

Sources

3 sources covering this story

• Dark Reading Mar 10

  Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit

  After several years of using simple implants, the Russia-affiliated threat actor is back with two new sophisticated malware tools.

• Help Net Security Mar 10

  This spy tool has been quietly stealing data for years - Help Net Security

  ESET researchers uncover the Sednit espionage toolkit targeting Ukrainian military personnel with two advanced implants since April 2024.

• ESET Research Mar 10

  Sednit reloaded: Back in the trenches

  ESET researchers document how the Sednit APT group has reemerged with a modern toolkit centered on two paired implants – BeardShell and Covenant.

Entities

• Sednit

Part of the PlainSec briefing for 2026-03-11

Editions

• Briefing for 2026-03-11

Related stories

• Iran-aligned actors escalate cyber attacks on US, allies
• KadNap infects 14,000+ routers to build proxy botnet