# APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage Campaign (CVE-2026-21509)

> Russian GRU-linked APT28 (Fancy Bear/Sednit/UAC-0001) has conducted long-term espionage against Ukrainian military and government personnel since April 2024 using custom BEARDSHELL and SLIMAGENT implants alongside a heavily modified Covenant C2 framework. The campaign exploits CVE-2026-21509 (CVSS 7.8) for initial access via weaponized Office documents, leveraging Filen cloud storage for C2 and Icedrive API for data exfiltration.

- **Published:** 2026-03-10T12:00:00Z
- **Last reviewed:** 2026-03-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0204
- **ID:** TL-2026-0204
- **Severity:** HIGH (CVSS 7.8)
- **Category:** APT
- **Status:** SUPERSEDED
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509

## Description

APT28 (also tracked as Fancy Bear, Sednit, Forest Blizzard, BlueDelta, and UAC-0001 by CERT-UA) — attributed to Russia's GRU Unit 26165 — has been conducting a sustained espionage campaign against Ukrainian military personnel and government agencies since at least April 2024. The campaign employs a sophisticated multi-implant toolkit consisting of BEARDSHELL, SLIMAGENT, and a heavily customized variant of the open-source Covenant .NET post-exploitation framework.

BEARDSHELL is a C++ backdoor that downloads, decrypts (using ChaCha20-Poly1305), and executes PowerShell scripts, with results exfiltrated via the Icedrive cloud storage API. It employs a rare opaque predicate obfuscation technique previously observed in XTunnel, the network pivoting tool APT28 used during the 2016 Democratic National Committee (DNC) hack. Each compromised host creates a unique directory on Icedrive named using an FNV-1a hash of the computer name and hardware profile GUID. ESET assesses with high confidence that BEARDSHELL is part of Sednit's custom arsenal based on shared obfuscation with XTunnel.

SLIMAGENT is a C++ spyware component capable of keylogging, screenshot capture, and clipboard data collection. It produces HTML-formatted logs with color-coded fields (application names in blue, keystrokes in red, window names in green) and encrypts collected data using AES + RSA. SLIMAGENT evolved from XAgent, a backdoor APT28 deployed since the 2010s, with code similarities to samples detected targeting European government entities as early as 2018.

The Covenant C2 framework — whose official development ceased in April 2021 — has been heavily modified by APT28 for long-term espionage with a cloud-based C2 protocol. The C2 infrastructure has evolved through multiple cloud providers: pCloud (2023), Koofr (2024-2025), and Filen (since July 2025). The modified GruntHTTPStager uses cloud storage APIs as a C2 bridge with XOR encryption (key: EIZ4EG2K8R).

Initial access in the 2026 phase of this campaign leverages CVE-2026-21509 (CVSS 7.8), an OLE security feature bypass in Microsoft Office that allows attackers to craft documents bypassing OLE validation, causing Office to load a COM object (Shell.Explorer.1, CLSID {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}) that should be blocked. Zscaler documented this exploitation chain as Operation NeuSploit, where specially crafted RTF documents deliver MiniDoor (an Outlook email stealer), PixyNetLoader (a dropper), and Covenant Grunt implants. Earlier delivery vectors included Signal messenger with macro-laced documents.

The kill chain proceeds as follows: (1) spearphishing delivers a weaponized Office document exploiting CVE-2026-21509; (2) the exploit drops ctec.dll and windows.png containing steganographic shellcode, launching Covenant in-memory; (3) PlaySndSrv.dll decrypts shellcode from sample-03.wav to launch BEARDSHELL; (4) PixyNetLoader drops EhStoreShell.dll as a shellcode loader; (5) persistence is achieved via COM hijacking (multiple CLSIDs), scheduled tasks (OneDriveHealth), and registry modifications; (6) C2 communications route through Filen (Covenant) and Icedrive (BEARDSHELL) APIs; (7) MiniDoor exfiltrates email from Outlook to attacker-controlled addresses.

APT28 deploys BEARDSHELL and Covenant simultaneously with each implant communicating through a different cloud provider, providing redundancy — if one infrastructure channel is disrupted, attackers can quickly restore control through the other. This campaign represents a significant evolution in APT28's capabilities, combining custom malware development with abuse of legitimate cloud services to evade network-level detection.

---

**Revalidated on 2026-03-12**

**Expanded Targeting Scope:** Trellix research (February 2026) reveals targeting has expanded significantly beyond Ukraine to include European maritime and transport agencies across Poland, Slovenia, Turkey, Greece, and the UAE. A concentrated 72-hour spear-phishing wave (January 28-30, 2026) delivered at least 29 distinct lures, with target breakdown: defense ministries (40%), transportation/logistics operators (35%), and diplomatic entities (25%). This widens the threat profile from Ukraine-centric to pan-European with Middle Eastern reach.

**Notdoor Technical Detail:** Lab52 and Trellix provide deeper technical analysis of NotDoor, an Outlook VBA backdoor in the campaign arsenal. NotDoor implements email surveillance through dual automatic triggers: Application_MAPILogonComplete (executes upon Outlook login) and Application_NewMailEx (activates upon new message arrival for real-time forwarding). It is designed for long-term email intelligence collection rather than interactive C2, exfiltrating messages to attacker-controlled addresses.

**Parallel Campaign Context:** ClearSky disclosed a parallel APT28-linked campaign (March 5, 2026) deploying previously undocumented BadPaw (.NET loader) and MeowMeow backdoor against Ukrainian entities. The attack chain uses Ukrainian border-crossing-themed phishing lures. MeowMeow employs anti-analysis checks (requires '-v' parameter, sandbox detection, forensic tool monitoring for Wireshark/Procmon/Ollydbg/Fiddler) and includes a decoy GUI with a cat picture. Attribution is moderate confidence based on targeting, lure geopolitics, and technique overlaps. This establishes that APT28 is operating at least two concurrent campaign tracks against Ukraine.

**Beardshell Obfuscation Formula:** ESET confirmed the specific opaque predicate formula shared between BEARDSHELL and XTunnel: 2(x^2 + 1) = y^2 + 3. This mathematical linkage provides high-confidence attribution to Sednit/APT28, as XTunnel was used exclusively by Sednit from 2013 to 2016.

**Recommended Target Sector Update:** Add 'maritime' and 'transportation/logistics' to target_sectors based on Trellix findings.

**Recommended Target Region Update:** Add 'Poland', 'Slovenia', 'Turkey', 'Greece', 'United Arab Emirates' to target_regions or expand 'Europe' to include specific affected countries and Middle Eastern presence.

## MITRE ATT&CK

- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1129 Shared Modules
- T1053 Scheduled Task/Job
- T1106 Native API
- T1546 Event Triggered Execution
- T1547 Boot or Logon Autostart Execution
- T1137 Office Application Startup
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1056 Input Capture
- T1113 Screen Capture
- T1115 Clipboard Data
- T1114 Email Collection
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1001 Data Obfuscation
- T1567 Exfiltration Over Web Service
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1082 System Information Discovery

## Sources

- [CERT-UA Alert UAC-0001: APT28 BEARDSHELL Campaign](https://cert.gov.ua/article/6282174)
- [ESET Research: Sednit Reloaded — Back in the Trenches](https://www.welivesecurity.com/en/eset-research/sednit-reloaded-back-trenches/)
- [Zscaler: APT28 Leverages CVE-2026-21509 — Operation NeuSploit](https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit)
- [Microsoft Security Response Center: CVE-2026-21509](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509)
- [NVD — CVE-2026-21509](https://nvd.nist.gov/vuln/detail/CVE-2026-21509)
- [CISA Known Exploited Vulnerabilities: CVE-2026-21509](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [THN: APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military](https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html)
- [BleepingComputer: APT28 Deploys Customized Covenant C2 Tool](https://www.bleepingcomputer.com/news/security/apt28-hackers-deploy-customized-variant-of-covenant-open-source-tool/)
- [SecurityAffairs: APT28 Conducts Long-term Espionage on Ukrainian Forces](https://securityaffairs.com/189230/apt/apt28-conducts-long-term-espionage-on-ukrainian-forces-using-custom-malware.html)
- [Sekoia: APT28 Operation Phantom Net Voxel](https://blog.sekoia.io/apt28-operation-phantom-net-voxel/)
- [SOC Prime: UAC-0001 (APT28) BEARDSHELL and COVENANT Detection](https://socprime.com/blog/detect-uac-0001-aka-apt28-attacks-against-ukraine/)
- [Picus Security: CVE-2026-21509 APT28 Exploitation Analysis](https://www.picussecurity.com/resource/blog/cve-2026-21509-apt28-exploits-microsoft-office-zero-day-vulnerability)
- [Recorded Future: Russian Military Hackers Revive Advanced Malware](https://therecord.media/russia-apt-28-revives-malware-to-spy-on-ukraine)
- [ESET GitHub: Sednit Malware IOCs](https://github.com/eset/malware-ioc/tree/master/sednit)
- [eSentire: Microsoft Office Emergency Out-of-Band Update CVE-2026-21509](https://www.esentire.com/security-advisories/microsoft-office-emergency-out-of-band-update-cve-2026-21509)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0204