APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage Campaign (CVE-2026-21509)
APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 (TL-2026-0204), also tracked as Operation NeuSploit, is a high-severity advanced persistent threat campaign scored CVSS 7.8, first published 2026-03-10. It is attributed to APT28 (Russia) with high confidence, affects Microsoft Microsoft Office 2016, references 1 CVE (CVE-2026-21509), maps to 27 MITRE ATT&CK techniques (T1001, T1005, T1027), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-0204
- Threat ID
- TL-2026-0204
- Also known as
- Operation NeuSploit, UAC-0001 Campaign, Sednit Reloaded
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- SUPERSEDED
- Category
- APT
- First published
- 2026-03-10
- Last reviewed
- 2026-03-10
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- military, defense, government, diplomatic
- Target regions
- Ukraine, Eastern Europe, Europe
- Detection rules
- 9
- Indicators of compromise
- 41
Malware and tooling in APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
Malware and tooling: BEARDSHELL, MiniDoor, PixyNetLoader, SLIMAGENT, Covenant, Covenant GruntHTTPStager
Russian GRU-linked APT28 (Fancy Bear/Sednit/UAC-0001) has conducted long-term espionage against Ukrainian military and government personnel since April 2024 using custom BEARDSHELL and SLIMAGENT implants alongside a heavily modified Covenant C2 framework. The campaign exploits CVE-2026-21509 (CVSS 7.8) for initial access via weaponized Office documents, leveraging Filen cloud storage for C2 and Icedrive API for data exfiltration.
How APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 works
APT28 (also tracked as Fancy Bear, Sednit, Forest Blizzard, BlueDelta, and UAC-0001 by CERT-UA) — attributed to Russia's GRU Unit 26165 — has been conducting a sustained espionage campaign against Ukrainian military personnel and government agencies since at least April 2024. The campaign employs a sophisticated multi-implant toolkit consisting of BEARDSHELL, SLIMAGENT, and a heavily customized variant of the open-source Covenant .NET post-exploitation framework.
BEARDSHELL is a C++ backdoor that downloads, decrypts (using ChaCha20-Poly1305), and executes PowerShell scripts, with results exfiltrated via the Icedrive cloud storage API. It employs a rare opaque predicate obfuscation technique previously observed in XTunnel, the network pivoting tool APT28 used during the 2016 Democratic National Committee (DNC) hack. Each compromised host creates a unique directory on Icedrive named using an FNV-1a hash of the computer name and hardware profile GUID. ESET assesses with high confidence that BEARDSHELL is part of Sednit's custom arsenal based on shared obfuscation with XTunnel.
SLIMAGENT is a C++ spyware component capable of keylogging, screenshot capture, and clipboard data collection. It produces HTML-formatted logs with color-coded fields (application names in blue, keystrokes in red, window names in green) and encrypts collected data using AES + RSA. SLIMAGENT evolved from XAgent, a backdoor APT28 deployed since the 2010s, with code similarities to samples detected targeting European government entities as early as 2018.
The Covenant C2 framework — whose official development ceased in April 2021 — has been heavily modified by APT28 for long-term espionage with a cloud-based C2 protocol. The C2 infrastructure has evolved through multiple cloud providers: pCloud (2023), Koofr (2024-2025), and Filen (since July 2025). The modified GruntHTTPStager uses cloud storage APIs as a C2 bridge with XOR encryption (key: EIZ4EG2K8R).
Initial access in the 2026 phase of this campaign leverages CVE-2026-21509 (CVSS 7.8), an OLE security feature bypass in Microsoft Office that allows attackers to craft documents bypassing OLE validation, causing Office to load a COM object (Shell.Explorer.1, CLSID {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}) that should be blocked. Zscaler documented this exploitation chain as Operation NeuSploit, where specially crafted RTF documents deliver MiniDoor (an Outlook email stealer), PixyNetLoader (a dropper), and Covenant Grunt implants. Earlier delivery vectors included Signal messenger with macro-laced documents.
The kill chain proceeds as follows: (1) spearphishing delivers a weaponized Office document exploiting CVE-2026-21509; (2) the exploit drops ctec.dll and windows.png containing steganographic shellcode, launching Covenant in-memory; (3) PlaySndSrv.dll decrypts shellcode from sample-03.wav to launch BEARDSHELL; (4) PixyNetLoader drops EhStoreShell.dll as a shellcode loader; (5) persistence is achieved via COM hijacking (multiple CLSIDs), scheduled tasks (OneDriveHealth), and registry modifications; (6) C2 communications route through Filen (Covenant) and Icedrive (BEARDSHELL) APIs; (7) MiniDoor exfiltrates email from Outlook to attacker-controlled addresses.
APT28 deploys BEARDSHELL and Covenant simultaneously with each implant communicating through a different cloud provider, providing redundancy — if one infrastructure channel is disrupted, attackers can quickly restore control through the other. This campaign represents a significant evolution in APT28's capabilities, combining custom malware development with abuse of legitimate cloud services to evade network-level detection.
---
**Revalidated on 2026-03-12**
**Expanded Targeting Scope:** Trellix research (February 2026) reveals targeting has expanded significantly beyond Ukraine to include European maritime and transport agencies across Poland, Slovenia, Turkey, Greece, and the UAE. A concentrated 72-hour spear-phishing wave (January 28-30, 2026) delivered at least 29 distinct lures, with target breakdown: defense ministries (40%), transportation/logistics operators (35%), and diplomatic entities (25%). This widens the threat profile from Ukraine-centric to pan-European with Middle Eastern reach.
**Notdoor Technical Detail:** Lab52 and Trellix provide deeper technical analysis of NotDoor, an Outlook VBA backdoor in the campaign arsenal. NotDoor implements email surveillance through dual automatic triggers: Application_MAPILogonComplete (executes upon Outlook login) and Application_NewMailEx (activates upon new message arrival for real-time forwarding). It is designed for long-term email intelligence collection rather than interactive C2, exfiltrating messages to attacker-controlled addresses.
**Parallel Campaign Context:** ClearSky disclosed a parallel APT28-linked campaign (March 5, 2026) deploying previously undocumented BadPaw (.NET loader) and MeowMeow backdoor against Ukrainian entities. The attack chain uses Ukrainian border-crossing-themed phishing lures. MeowMeow employs anti-analysis checks (requires '-v' parameter, sandbox detection, forensic tool monitoring for Wireshark/Procmon/Ollydbg/Fiddler) and includes a decoy GUI with a cat picture. Attribution is moderate confidence based on targeting, lure geopolitics, and technique overlaps. This establishes that APT28 is operating at least two concurrent campaign tracks against Ukraine.
**Beardshell Obfuscation Formula:** ESET confirmed the specific opaque predicate formula shared between BEARDSHELL and XTunnel: 2(x^2 + 1) = y^2 + 3. This mathematical linkage provides high-confidence attribution to Sednit/APT28, as XTunnel was used exclusively by Sednit from 2013 to 2016.
**Recommended Target Sector Update:** Add 'maritime' and 'transportation/logistics' to target_sectors based on Trellix findings.
**Recommended Target Region Update:** Add 'Poland', 'Slovenia', 'Turkey', 'Greece', 'United Arab Emirates' to target_regions or expand 'Europe' to include specific affected countries and Middle Eastern presence.
MITRE ATT&CK techniques used in TL-2026-0204
command-and-control
T1001 Data Obfuscation; T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1114 Email Collection; T1115 Clipboard Data
defense-evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1203 Exploitation for Client Execution; T1204 User Execution
discovery
T1082 System Information Discovery
persistence
T1137 Office Application Startup; T1547 Boot or Logon Autostart Execution
privilege-escalation
T1546 Event Triggered Execution
initial-access
exfiltration
T1567 Exfiltration Over Web Service
resource-development
Affected products and versions in APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
- Microsoft — Microsoft Office 2016
Vulnerable versions: x86; x64
Fixed in: KB5002713 - Microsoft — Microsoft Office 2019
Vulnerable versions: x86; x64
Fixed in: January 2026 cumulative update - Microsoft — Microsoft Office LTSC 2021
Vulnerable versions: x86; x64
Fixed in: January 2026 cumulative update - Microsoft — Microsoft Office LTSC 2024
Vulnerable versions: x86; x64
Fixed in: January 2026 cumulative update - Microsoft — Microsoft 365 Apps for Enterprise
Vulnerable versions: x86; x64
Fixed in: January 2026 cumulative update
Remediation for APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
Patches
- KB5002713 — Microsoft Office 2016 security update (January 26, 2026)
- Microsoft Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps — apply latest cumulative update
Immediate actions
- Apply Microsoft emergency out-of-band patch KB5002713 for CVE-2026-21509 immediately
- Block domains freefoodaid.com and wellnesscaremed.com at perimeter
- Hunt for COM hijacking artifacts in HKCU\Software\Classes\CLSID\ registry paths
- Search for scheduled task named OneDriveHealth on all endpoints
- Monitor for anomalous traffic to Filen, Icedrive, and Koofr cloud storage APIs
- Scan for known file hashes across all endpoints using EDR
Workarounds
- Apply Microsoft registry key modifications for Office COM Compatibility path as interim mitigation
- Disable OLE object embedding in Office documents via Group Policy
- Block macro execution in documents originating from the internet (Mark of the Web)
Longer-term hardening
- Deploy EDR with behavioral detection for COM hijacking and opaque predicate obfuscation
- Implement application whitelisting to prevent unauthorized DLL loading
- Enable cloud API traffic inspection to detect C2 abuse of legitimate storage services
- Conduct email security awareness training focused on weaponized Office documents
- Implement macro execution policies restricting VBA in documents from external sources
- Monitor Signal Desktop for suspicious file transfers in sensitive environments
CVEs associated with APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
Weaknesses (CWE) in APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
CWE-807
Timeline of APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
Showing the 20 most recent tracked events.
- APT28 Covenant variant uses pCloud cloud storage service for C2 communications
- BEARDSHELL, SLIMAGENT, and Covenant campaign against Ukrainian military personnel begins; initial delivery via Signal messenger with macro-laced documents
- Covenant C2 infrastructure transitions from pCloud to Koofr cloud storage API (app.koofr.net)
- CERT-UA publicly documents SLIMAGENT spyware component in advisory about UAC-0001 activity
- Covenant C2 infrastructure transitions from Koofr to Filen cloud storage service for enhanced operational security
- Sekoia publishes Operation Phantom Net Voxel analysis documenting APT28 weaponized Office document delivery via Signal
- Microsoft releases emergency out-of-band patch KB5002713 for CVE-2026-21509 OLE security feature bypass in Office
- CISA adds CVE-2026-21509 to Known Exploited Vulnerabilities catalog with February 16, 2026 remediation deadline
- APT28 launches concentrated 72-hour spear-phishing wave (Jan 28-30) delivering 29 distinct CVE-2026-21509 lures across 9 Eastern European nations targeting defense (40%), transport/logistics (35%), and diplomatic (25%) entities [Source: https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/]
- In-the-wild exploitation of CVE-2026-21509 confirmed by Microsoft; APT28 identified as primary threat actor
- Help Net Security publishes early reporting on Russian hackers exploiting CVE-2026-21509 within 48 hours of patch release [Source: https://www.helpnetsecurity.com/2026/02/03/russian-hackers-are-exploiting-recently-patched-microsoft-office-vulnerability-cve-2026-21509/]
- Trellix publishes detailed analysis of APT28 multi-stage campaign, revealing expanded targeting to European maritime and transport agencies in Poland, Slovenia, Turkey, Greece, and UAE [Source: https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/]
- Picus Security publishes CVE-2026-21509 exploitation analysis with APT28 attribution [Source: https://www.picussecurity.com/resource/blog/cve-2026-21509-apt28-exploits-microsoft-office-zero-day-vulnerability]
- Zscaler publishes Operation NeuSploit analysis documenting APT28 exploitation of CVE-2026-21509 with MiniDoor, PixyNetLoader, and Covenant Grunt payloads
- ClearSky discloses parallel APT28-linked campaign deploying BadPaw loader and MeowMeow backdoor against Ukrainian entities via border-crossing-themed phishing lures [Source: https://thehackernews.com/2026/03/apt28-linked-campaign-deploys-badpaw.html]
- CERT-UA publishes advisory on UAC-0001 (APT28) targeting Ukrainian government agencies with BEARDSHELL and COVENANT
- Dark Reading reports on Sednit resurface with sophisticated toolkit, amplifying public awareness of the BEARDSHELL/Covenant dual-implant architecture [Source: https://www.darkreading.com/cyber-risk/sednit-resurfaces-with-sophisticated-new-toolkit]
- SOC Prime publishes community Sigma detection rules for UAC-0001 BEARDSHELL and COVENANT artifact detection [Source: https://socprime.com/blog/detect-uac-0001-aka-apt28-attacks-against-ukraine/]
- ESET publishes comprehensive Sednit Reloaded research confirming BEARDSHELL attribution to APT28 via shared opaque predicate obfuscation with XTunnel
- As of 2026-05-29, APT28 (GRU Unit 26165) remains fully operational and CVE-2026-21509 is patched (emergency OOB fix late Jan 2026) and in CISA KEV, but the BEARDSHELL/COVENANT/Neusploit campaign tracked here has been overtaken. Current April-May 2026 reporting shows a successor PRISMEX malware operation against Ukraine and NATO allies leading active APT28 activity.
Sources cited for APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
- CERT-UA Alert UAC-0001: APT28 BEARDSHELL Campaign
- ESET Research: Sednit Reloaded — Back in the Trenches
- Zscaler: APT28 Leverages CVE-2026-21509 — Operation NeuSploit
- Microsoft Security Response Center: CVE-2026-21509
- NVD — CVE-2026-21509
- CISA Known Exploited Vulnerabilities: CVE-2026-21509
- THN: APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military
- BleepingComputer: APT28 Deploys Customized Covenant C2 Tool
- SecurityAffairs: APT28 Conducts Long-term Espionage on Ukrainian Forces
- Sekoia: APT28 Operation Phantom Net Voxel
- SOC Prime: UAC-0001 (APT28) BEARDSHELL and COVENANT Detection
- Picus Security: CVE-2026-21509 APT28 Exploitation Analysis
- Recorded Future: Russian Military Hackers Revive Advanced Malware
- ESET GitHub: Sednit Malware IOCs
- eSentire: Microsoft Office Emergency Out-of-Band Update CVE-2026-21509
Threats related to APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2
- Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting Ukrainian Defense Supply Chain
- APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)
- APT28 Router DNS Hijacking for Adversary-in-the-Middle Credential Theft
- APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaign
- CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)
- APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing
Detection coverage for TL-2026-0204
As of 2026-03-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0204 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.