MalwareUsed by 2 actorsExploits 1 CVE

SlimAgent

SlimAgent is a C++ spyware implant for Windows used by the Russian cyberespionage group APT28, also known as Sednit and Fancy Bear. It records keystrokes, captures screenshots, and collects clipboard data. Its keylogging output uses HTML formatting to distinguish application names, window titles, and captured input. Screenshots are captured through Windows APIs, encrypted using AES and RSA, and stored locally with timestamps.

SlimAgent was discovered on a Ukrainian government computer in April 2024 and publicly documented in June 2025. It has been deployed alongside the BeardShell backdoor, including in attacks against Ukrainian government organizations using social engineering through Signal chats. Code-level similarities in keylogging logic and HTML log formatting link SlimAgent to the keylogger module of APT28’s older X-Agent implant. Related samples sharing its codebase were used against governmental entities in two European countries as early as 2018.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-21509Microsoft Office COM/OLE Security Feature BypassExploited in the wild

The two pieces of malware have been used recently to target central executive bodies of Ukraine in attacks that exploited the CVE-2026-21509 vulnerability in Microsoft Office via malicious DOC files.

via bleeping computerbleepingcomputer.com

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT28

CORESHELL, Komplex, SlimAgent, JHUHUGIT, Seduploader

via cyfirma blogcyfirma.com

APT29

The researchers uncovered these malware families after discovering SlimAgent, a keylogging implant deployed in a Ukrainian government system capable of keystroke capture, clipboard collection, and screenshot capture.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

MITRE ATT&CK techniques ... T1587.001 Develop Capabilities: Malware BeardShell and SlimAgent are custom malware.

Initial Access

2 techniques

T1566PhishingEvidence1

Spear phishing campaigns or the SedKit exploit kit delivered the Seduploader first stage.

T1566.001Spearphishing AttachmentEvidence1

“Sednit typically compromises its targets through social engineering over Signal Desktop or WhatsApp Desktop, persuading them to open Trojanized Excel or Word documents. In some cases, the attackers even call their targets to increase the chances of success.”

Execution

3 techniques

T1059.001PowerShellEvidence1

It can execute PowerShell commands in a .NET runtime environment and was used together with SlimAgent.

T1129Shared ModulesEvidence1

MITRE ATT&CK techniques ... T1129 Shared Modules BeardShell and SlimAgent are full-fledged DLL files.

T1203Exploitation for Client ExecutionEvidence1

The two pieces of malware have been used recently to target central executive bodies of Ukraine in attacks that exploited the CVE-2026-21509 vulnerability in Microsoft Office via malicious DOC files.

Persistence

1 technique

T1546.015Component Object Model HijackingEvidence1

MITRE ATT&CK techniques ... T1546.015 Event Triggered Execution: Component Object Model Hijacking BeardShell and SlimAgent are made persistent by hijacking COM objects.

Privilege Escalation

1 technique

T1546.015Component Object Model HijackingEvidence1

MITRE ATT&CK techniques ... T1546.015 Event Triggered Execution: Component Object Model Hijacking BeardShell and SlimAgent are made persistent by hijacking COM objects.

Stealth

2 techniques

T1480Execution GuardrailsEvidence1

MITRE ATT&CK techniques ... T1480 Execution Guardrails BeardShell only executes in taskhost.exe or taskhostw.exe. SlimAgent only executes in explorer.exe.

T1564Hide ArtifactsEvidence1

MITRE ATT&CK techniques ... T1564 Hide Artifacts SlimAgent logs are written into a hidden file.

Credential Access

1 technique

T1056.001KeyloggingEvidence13

在同一操作基础设施上发现的名为Slimagent的键盘记录器,与APT28十多年前的标志性植入程序X-Agent有直接代码渊源。

Collection

4 techniques

T1005Data from Local SystemEvidence1

MITRE ATT&CK techniques ... T1005 Data from Local System BeardShell, Covenant, and SlimAgent collect data from a compromised machine.

T1056.001KeyloggingEvidence13

在同一操作基础设施上发现的名为Slimagent的键盘记录器,与APT28十多年前的标志性植入程序X-Agent有直接代码渊源。

T1113Screen CaptureEvidence7

SlimAgent is a simple yet efficient spying tool capable of logging keystrokes, capturing screenshots, and collecting clipboard data.

T1115Clipboard DataEvidence5

SlimAgent is a simple yet efficient spying tool capable of logging keystrokes, capturing screenshots, and collecting clipboard data.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

该组织从稳定的恶意软件框架转向部署短效、单一用途的工具,一旦暴露立即弃用。

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

Результаты выгружаются как зашифрованные изображения с расширениями .bmp/.gif/.jpeg/.png/.tiff через тот же облачный канал (T1041, T1567.002).

T1567.002Exfiltration to Cloud StorageEvidence1

...эксфильтрация документов через тот же облачный канал (Exfiltration to Cloud Storage, T1567.002).

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 months ago

hash.sha1●●●●●●●●●●●●View more in app7 months ago

ACTIVITY FEED

Recent activity

22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

22 SOURCESView more in app

malpediaNews

Jul 23, 2026

APT28 (Threat Actor)

Named malware/tool in the Sednit/APT28 arsenal; exact function is not described in the provided content.

codebyNews

Jun 14, 2026

Sigma и YARA правила APT28: детекция стего и cloud C2

Collection component used for espionage that captures keystrokes and screenshots, then exfiltrates the results as encrypted image files through the same cloud-based channel.

cyber security newsNews

Jun 12, 2026

Fancy Bear Hackers Abuse EdgeRouters and Cloud Services to Launch Stealthy Cyberattacks

A keylogger linked by code lineage to X-Agent and found on infrastructure associated with APT28 operations.

freebufNews

Jun 12, 2026

黑客组织Fancy Bear滥用边缘路由器与云服务发起隐秘网络攻击 - FreeBuf网络安全行业门户

键盘记录器，与APT28早期植入程序X-Agent存在直接代码渊源。

+18 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SlimAgent