# EasterBunny: advanced modular espionage implant attributed to APT29 (SVR)

> Lab52 (S2 Grupo) published its analysis of EasterBunny, a highly customized, multi-layered espionage implant family attributed to APT29 and recovered during a 2019 incident-response engagement. The artifacts were declassified beginning November 2025 and the report was released on 2026-05-06.

- **Published:** 2026-10-17T21:14:15Z
- **Last reviewed:** 2026-10-17T21:14:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3839
- **ID:** TL-2026-3839
- **Severity:** HIGH
- **Category:** APT
- **Status:** TRACKING
- **Actor:** APT29 (Russia)
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In 2019, as part of S2 Grupo's incident management service, Lab52 gained access to a set of artifacts and a large body of evidence collected during an incident. The investigation linked the campaign to APT29, which is allegedly associated with the Russian Foreign Intelligence Service (SVR). Lab52 named the malware EasterBunny and describes it as the most advanced APT29 implant it has examined. Starting in November 2025 the information was declassified, and the results were compiled into a detailed report (LAB52EasterBunny.pdf) published on 2026-05-06.

Public descriptions of the report characterize EasterBunny as exceptionally sophisticated, with a modular architecture built as a multi-layered pipeline designed to maximize stealth and complicate attribution. The malware and the supporting infrastructure were completely tailored to the victim. This level of customization made detection with conventional indicators of compromise (hashes, domains, IP addresses) unfeasible, and the report accordingly publishes no conventional network or hash IOCs. Lab52 also assesses that a complex control platform to build, configure and operate the EasterBunny family probably exists.

Secondary summaries of the report describe a loader-based design. Pubpool.dll acts as a DLL loader for three encrypted DLLs, decrypting and loading them. The artifacts are built in a 'matryoshka' (nesting-doll) manner of roughly four independent execution stages, where each layer prepares the next. The Stage 3 implant is described as a wrapper carrying encrypted shellcode scattered across hundreds of blocks in .text and reassembled at runtime through an index table. The shellcode is decrypted with keys derived from host artifacts (machine-bound), and the innermost layer is a reflective position-independent-code payload. API resolution is done by walking the PEB (gs:[0x60]). One search-engine summary further states that the sample enumerates DLLs in System32, selects one whose .text section is at least 782629 bytes (the shellcode size) and writes the shellcode into that section, and that payload memory is allocated with a 4096-byte zero-filled offset to frustrate memory-forensics tools that inspect only the start of a page. These details come from secondary summaries and could not be verified against the PDF, which could not be parsed in this run (the S2 Grupo copy exceeds the fetch size limit and the Lab52 copy returned compressed binary). Treat them as lower-confidence until checked against the report.

The Lab52 web page lists no CVEs, victims, sectors, hashes or network infrastructure. Victim identity and geography are not stated in the sources reviewed. One secondary summary mentions a 2019 SVR operation in Spain, but no primary source reviewed confirms this, so it is not asserted here. Lab52 offers further intelligence on this campaign through its private feed. Because the activity dates to 2019 and is retrospective, defenders should use the behavioral and structural characteristics (encrypted DLL loaders, machine-bound decryption, reflective loading, PEB-walk API resolution, shellcode hosted in System32 DLL .text sections) for retro-hunting rather than relying on atomic indicators.

## MITRE ATT&CK

- T1587.001 Malware
- T1129 Shared Modules
- T1027 Obfuscated Files or Information
- T1027.007 Dynamic API Resolution
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1480.001 Environmental Keying
- T1620 Reflective Code Loading
- T1055 Process Injection

## Sources

- [EasterBunny: advanced espionage artifacts attributed to APT29 (Lab52)](https://lab52.io/blog/easterbunny/)
- [Lab52 EasterBunny full report (PDF)](https://lab52.io/blog/wp-content/uploads/2026/05/LAB52EasterBunny.pdf)
- [S2 Grupo - Informe LAB52 EasterBunny Complete (PDF)](https://home.s2grupo.es/hubfs/Informe%20LAB52-%20EasterBunny_Complete.pdf)
- [Lab52 blog post metadata (WordPress API, post 3188)](https://lab52.io/blog/wp-json/wp/v2/posts/3188)
- [Lab52 tag page: EasterBunny](https://lab52.io/blog/tag/easterbunny/)
- [Malware Analysis, News and Indicators: EasterBunny thread](https://malware.news/t/easterbunny-advanced-espionage-artifacts-attributed-to-apt29/106709)
- [This Week in 4n6 - Week 19 2026](https://thisweekin4n6.com/2026/05/10/week-19-2026/)
- [SOCRadar IOC Radar: EasterBunny report entry](https://socradar.io/free-tools/ioc-radar/reports/easterbunny-advanced-espionage-artifacts-attributed-to-apt29-7bffb32527c9)
- [Information Security Knowledge Base (gm7.org): APT29 custom espionage trojan summary (Chinese-language, secondary)](https://www.gm7.org/archives/96052)
- [Lab52: New tricks of APT29 (prior APT29 research)](https://lab52.io/blog/2162-2/)
- [Lab52: New invitation from APT29 to use CCleaner (prior APT29 research)](https://lab52.io/blog/2344-2/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3839