Loading malware…
BeardShell is a custom C++ backdoor used by the Russian state-sponsored espionage group APT28, also tracked as Sednit and Fancy Bear. It emerged in sustained operations from April 2024 onward and has been used primarily against Ukrainian military personnel, as well as related government and defense-linked targets, including drone manufacturers and research organizations. The malware is associated with long-term surveillance and post-compromise persistence rather than disruptive or destructive activity.
BeardShell executes attacker-supplied PowerShell commands on compromised Windows systems, reportedly within a .NET runtime environment, and returns execution results through a cloud-based command channel. Its command-and-control design abuses legitimate cloud storage infrastructure, most notably Icedrive, and some reporting describes the broader operational pattern as rotating cloud storage backends to improve resilience and reduce detection. BeardShell has also been observed extracting command-and-control information from images stored in cloud services and using strong encryption layered over standard web traffic. The malware employs obfuscation, including a rare opaque-predicate technique previously associated with APT28 tooling such as XTunnel, supporting its attribution to the group’s custom malware lineage.
Operational reporting consistently places BeardShell in multi-stage intrusion chains. It has been deployed alongside other APT28 tooling including the modified Covenant framework, SlimAgent, and in some campaigns NotDoor and lightweight loaders. In these operations, BeardShell functions as a durable espionage implant and in some cases as a fallback or recovery implant to preserve access if other tooling is disrupted. Related campaigns used social engineering and spearphishing with weaponized Office documents, including delivery through email and messaging platforms used by targets, followed by staged loaders, steganographic payload concealment, persistence mechanisms, and in-memory execution.
BeardShell is part of APT28’s renewed shift back toward bespoke implants after a period in which the group more often relied on simpler malware and phishing tradecraft. Its use of legitimate cloud services for command and control, combined with stealth-oriented loading chains and close integration with other APT28 espionage components, makes it a notable example of modern GRU-linked cyber-espionage tooling focused on covert access, persistence, and long-term intelligence collection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers weaponized a newly disclosed Microsoft Office 1-day (CVE-2026-21509) within 24 hours of its public revelation... CVE-2026-21509, a Microsoft Office security feature bypass vulnerability... allows embedded OLE objects to execute by leveraging the WebDAV protocol to fetch external payloads from attacker-controlled infrastructure.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
2026-03-10 ⋅ ESET Research ⋅ Sednit reloaded: Back in the trenches BEARDSHELL GRUNT SLIMAGENT X-Agent XTunnel
a new backdoor called BeardShell ... written in C++, establishes persistence, executes PowerShell commands, and hides files under fake image headers.
Researchers at cybersecurity company ESET noticed that since April 2024, the Russian group has started using in attacks two implants named BeardShell and Covenant.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK techniques ... T1583.006 Acquire Infrastructure: Web Services BeardShell relies on Icedrive cloud storage. Covenant relies on Filen cloud storage.
Spear phishing campaigns or the SedKit exploit kit delivered the Seduploader first stage.
APT28’s attack begins with spear-phishing emails containing weaponized documents that exploit CVE-2026-21509... They noted that the APT28 adversary orchestrated a concentrated 72-hour spear-phishing campaign... delivering at least 29 distinct emails across nine Eastern European nations.
The researchers detailed that the malware establishes persistence by hijacking a COM object and briefly creating a scheduled task, ‘OneDriveHealth,’ to restart explorer[dot]exe and trigger the malicious load before deleting itself.
BeardShell is a sophisticated implant capable of executing PowerShell commands within a .NET runtime environment...
MITRE ATT&CK techniques ... T1129 Shared Modules BeardShell and SlimAgent are full-fledged DLL files.
The attackers moved quickly, weaponizing a newly disclosed Microsoft Office one-day vulnerability, CVE-2026-21509, within 24 hours of its public disclosure... When victims open these malicious documents, the exploit triggers automatically without requiring macros or user interaction.
The researchers detailed that the malware establishes persistence by hijacking a COM object and briefly creating a scheduled task, ‘OneDriveHealth,’ to restart explorer[dot]exe and trigger the malicious load before deleting itself.
MITRE ATT&CK techniques ... T1027 Obfuscated Files or Information BeardShell Icedrive token decryption is obfuscated.
Стеганография (T1027.003) прячет payload от файлового анализа: PNG с шеллкодом - не исполняемый файл...
BeardShell uses lightweight anti-analysis checks to evade sandboxes, decrypts embedded strings, and dynamically resolves Windows APIs.
The entire chain is designed for resilience and evasion, utilizing encrypted payloads, legitimate cloud services for C2, in-memory execution, and process injection to minimize forensic artifacts.
MITRE ATT&CK techniques ... T1140 Deobfuscate/Decode Files or Information BeardShell decrypts its strings.
MITRE ATT&CK techniques ... T1480 Execution Guardrails BeardShell only executes in taskhost.exe or taskhostw.exe. SlimAgent only executes in explorer.exe.
MITRE ATT&CK techniques ... T1001 Data Obfuscation BeardShell exfiltrates data in fake images.
The extracted shellcode, ultimately, is used to load an embedded .NET assembly, which is nothing but a Grunt implant associated with the open source .NET COVENANT command-and-control (C2) framework.
在"Operation Phantom Net Voxel"行动中,该组织部署了一个名为BeardShell的定制C++后门,使用云存储API作为其命令通道。
BeardShell ... leverages the legitimate cloud storage service Icedrive as its C&C channel... Previously, in 2023, Sednit’s Covenant abused the legitimate cloud service pCloud, and in 2024–2025, Koofr ... Figure 11 shows the classes introduced by Sednit developers to communicate with the Filen cloud provider, used since July 2025.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware in the Sednit/APT28 toolset; later content explicitly ties it to attacks on public authorities and describes related tooling in the intrusion set.
Implant/backdoor used in the APT28 campaign to extract C2 addresses from steganographic PNG images stored in cloud services and communicate over HTTPS via Icedrive API with additional ChaCha20-Poly1305 encryption layered over TLS.
A custom C++ backdoor that uses a legitimate cloud storage API as its command-and-control channel to blend malicious traffic with trusted cloud service activity.
定制C++后门，使用合法云存储API作为命令与控制通道以规避检测。
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.