Threat reportAPTTL-2026-3839
EasterBunny: advanced modular espionage implant attributed to APT29 (SVR)
EasterBunny: advanced modular espionage implant attributed (TL-2026-3839), also tracked as EasterBunny, is a high-severity advanced persistent threat campaign, first published 2026-10-17. It is attributed to APT29 (Russia) with medium confidence, maps to 9 MITRE ATT&CK techniques (T1027, T1027.007, T1027.013), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 1APT29
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3839
- Threat ID
- TL-2026-3839
- Also known as
- EasterBunny
- Severity
- HIGH
- Status
- TRACKING
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT29
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in EasterBunny: advanced modular espionage implant attributed
Malware and tooling: EasterBunny, EasterBunny Stage 3 implant
How EasterBunny: advanced modular espionage implant attributed works
Lab52 (S2 Grupo) published its analysis of EasterBunny, a highly customized, multi-layered espionage implant family attributed to APT29 and recovered during a 2019 incident-response engagement. The artifacts were declassified beginning November 2025 and the report was released on 2026-05-06.
In 2019, as part of S2 Grupo's incident management service, Lab52 gained access to a set of artifacts and a large body of evidence collected during an incident. The investigation linked the campaign to APT29, which is allegedly associated with the Russian Foreign Intelligence Service (SVR). Lab52 named the malware EasterBunny and describes it as the most advanced APT29 implant it has examined. Starting in November 2025 the information was declassified, and the results were compiled into a detailed report (LAB52EasterBunny.pdf) published on 2026-05-06.
Public descriptions of the report characterize EasterBunny as exceptionally sophisticated, with a modular architecture built as a multi-layered pipeline designed to maximize stealth and complicate attribution. The malware and the supporting infrastructure were completely tailored to the victim. This level of customization made detection with conventional indicators of compromise (hashes, domains, IP addresses) unfeasible, and the report accordingly publishes no conventional network or hash IOCs. Lab52 also assesses that a complex control platform to build, configure and operate the EasterBunny family probably exists.
Secondary summaries of the report describe a loader-based design. Pubpool.dll acts as a DLL loader for three encrypted DLLs, decrypting and loading them. The artifacts are built in a 'matryoshka' (nesting-doll) manner of roughly four independent execution stages, where each layer prepares the next. The Stage 3 implant is described as a wrapper carrying encrypted shellcode scattered across hundreds of blocks in .text and reassembled at runtime through an index table. The shellcode is decrypted with keys derived from host artifacts (machine-bound), and the innermost layer is a reflective position-independent-code payload. API resolution is done by walking the PEB (gs:[0x60]). One search-engine summary further states that the sample enumerates DLLs in System32, selects one whose .text section is at least 782629 bytes (the shellcode size) and writes the shellcode into that section, and that payload memory is allocated with a 4096-byte zero-filled offset to frustrate memory-forensics tools that inspect only the start of a page. These details come from secondary summaries and could not be verified against the PDF, which could not be parsed in this run (the S2 Grupo copy exceeds the fetch size limit and the Lab52 copy returned compressed binary). Treat them as lower-confidence until checked against the report.
The Lab52 web page lists no CVEs, victims, sectors, hashes or network infrastructure. Victim identity and geography are not stated in the sources reviewed. One secondary summary mentions a 2019 SVR operation in Spain, but no primary source reviewed confirms this, so it is not asserted here. Lab52 offers further intelligence on this campaign through its private feed. Because the activity dates to 2019 and is retrospective, defenders should use the behavioral and structural characteristics (encrypted DLL loaders, machine-bound decryption, reflective loading, PEB-walk API resolution, shellcode hosted in System32 DLL .text sections) for retro-hunting rather than relying on atomic indicators.
MITRE ATT&CK techniques used in TL-2026-3839
Defense Evasion
T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1027.013 Encrypted/Encoded File; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1480.001 Environmental Keying; T1620 Reflective Code Loading
Execution
Resource Development
Remediation for EasterBunny: advanced modular espionage implant attributed
Immediate actions
- Retro-hunt for unsigned or unexpected DLLs named Pubpool.dll and for DLLs loaded by non-standard processes that decrypt and map further DLLs in memory
- Hunt for reflective/in-memory PE loading and manual PEB-walk API resolution in EDR memory telemetry
- Compare System32 DLL .text sections on disk and in memory against known-good hashes to find shellcode hosted inside legitimate DLLs
- Review incident archives from 2019 onward for tailored implants that did not match public IOCs
Workarounds
- Application allow-listing to block execution of unapproved DLLs from user-writable paths
Longer-term hardening
- Deploy EDR with behavioral and in-memory scanning rather than relying on hash/domain/IP indicators
- Baseline loaded modules per host and alert on high-entropy DLL files on disk with no valid signature
- Retain long-horizon endpoint and network telemetry to support retrospective investigation of nation-state intrusions
Timeline of EasterBunny: advanced modular espionage implant attributed
- During 2019 (exact date not stated in sources; January 1 is a placeholder for the year) S2 Grupo incident management and Lab52 gained access to the EasterBunny artifacts and evidence collected during an incident
- Lab52 published earlier research 'New tricks of APT29' (May 2023; day not stated, first of month used as placeholder)
- Lab52 published 'New invitation from APT29 to use CCleaner' (July 2023; day not stated, first of month used as placeholder)
- Information on the EasterBunny artifacts began to be declassified starting November 2025 (day not stated, first of month used as placeholder) and compiled into a detailed report
- Lab52 published the blog post and the full LAB52EasterBunny.pdf report attributing the artifacts to APT29
- This Week in 4n6 Week 19 roundup listed the Lab52 EasterBunny article under malware analysis
Sources cited for EasterBunny: advanced modular espionage implant attributed
- EasterBunny: advanced espionage artifacts attributed to APT29 (Lab52)
- Lab52 EasterBunny full report (PDF)
- S2 Grupo - Informe LAB52 EasterBunny Complete (PDF)
- Lab52 blog post metadata (WordPress API, post 3188)
- Lab52 tag page: EasterBunny
- Malware Analysis, News and Indicators: EasterBunny thread
- This Week in 4n6 - Week 19 2026
- SOCRadar IOC Radar: EasterBunny report entry
- Information Security Knowledge Base (gm7.org): APT29 custom espionage trojan summary (Chinese-language, secondary)
- Lab52: New tricks of APT29 (prior APT29 research)
- Lab52: New invitation from APT29 to use CCleaner (prior APT29 research)
Detection coverage for TL-2026-3839
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3839 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.