ESET links Sednit (Unit 26165/GRU) to an espionage campaign active since April 2024. Operators used SlimAgent, BeardShell and Covenant to collect keystrokes, screenshots and clipboard data via cloud-hosted C2. Hunt indicators, isolate infected hosts and review cloud-storage logs.
Part of the PlainSec briefing for 2026-03-12