Loading story…
ESET reported that Sednit—the Russia-linked espionage group also tracked as APT28/Fancy Bear—has returned with renewed activity and updated tradecraft. The campaign reflects a continuation of the group's long-running intelligence collection operations, with researchers documenting refreshed malware and intrusion techniques designed to regain footholds in targeted environments and support covert data theft.
The report indicates the operators are back to conducting targeted intrusions against organizations of strategic interest, relying on stealthy persistence and modular tooling to maintain access while evading detection. The findings reinforce that Sednit remains an active and capable state-aligned threat actor, and that defenders should expect ongoing spearphishing, credential theft, and post-compromise lateral movement associated with the group's espionage playbook.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
ESET published a research article titled "Sednit reloaded: Back in the trenches," indicating renewed reporting on the Sednit threat group's operations. No additional incident details or dated events are provided in the reference content.
ESET published a research paper focused on the Sednit threat group, providing analysis of the group's activity and tactics. This marks an earlier documented research milestone on Sednit than the existing 2026 entry.
A spear-phishing campaign with suspected ties to the Russian government used a spoofed Electronic Frontier Foundation domain to target the White House. The activity represents an earlier documented operational event associated with the Sednit/APT28 threat cluster.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcewelivesecurity.com
Open sourceboingboing.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**APT28 (Sednit/Fancy Bear)**, a Russian GRU-linked cyber-espionage group associated with **Unit 26165**, has been assessed by ESET to have reactivated a more advanced, custom tooling set beginning in **April 2024**, shifting from a period where its most sophisticated malware was less frequently observed. The activity has focused on **long-term surveillance of Ukrainian targets**, particularly **military personnel**, and includes the use of multiple implants: **BEARDSHELL** (a .NET-based implant used to execute **PowerShell** commands) and **COVENANT** (used alongside BEARDSHELL), as well as **SLIMAGENT**, which performs keylogging, screenshot capture, and clipboard collection. ESET and reporting based on its findings link SLIMAGENT to historical **XAgent** development, citing code and logging-format similarities consistent with an evolution of APT28’s earlier backdoor ecosystem. ESET’s reporting indicates the operators use a **dual-implant architecture** to improve resilience, including leveraging **legitimate cloud services** for command-and-control; BEARDSHELL was described as using *Icedrive* as a C2 channel, and the overall approach was characterized as designed to maintain durable access for espionage operations extending through **2025 into 2026**. Separate weekly threat-bulletin coverage that mentions unrelated breaches and other threat activity does not add material detail to the APT28/Sednit campaign described above and should not be treated as part of the same incident reporting.
Jun 29, 2026
ESET reported that the **Sednit** espionage group, also known as **APT28/Fancy Bear**, used malware designed to breach **air-gapped networks** by spreading through removable media. The operation relied on USB devices to move malicious components into isolated environments, allowing the attackers to collect data from systems not directly connected to the internet and then exfiltrate it once the infected media was reconnected to an online machine. The campaign highlighted a deliberate focus on espionage rather than disruption, with tooling tailored to steal documents and system information from sensitive targets. By adapting its tradecraft to bypass physical network isolation, Sednit demonstrated that air gaps alone do not prevent compromise when attackers can exploit trusted workflows involving portable storage and cross-network file transfers.
Jul 12, 2026
ESET reported sustained global activity by China-, Iran-, North Korea-, and Russia-aligned threat actors across Q4 2025 and Q1 2026, with operations closely tied to geopolitical priorities. China-aligned groups targeted government, maritime, energy, and technology organizations in countries including Venezuela, Syria, Cambodia, Panama, and South Korea, and also abused **Ivanti VPN** environments. Iran-linked activity shifted during the late-February 2026 war in Iran: established APT operations declined, while proxy, hacktivist, and unattributed actors increased attacks against Israel and other perceived adversaries, including the use of destructive tooling described as a bootkit-style wiper. North Korea-aligned actors continued social-engineering and supply-chain campaigns aimed at developers and cryptocurrency ecosystems, including a Lazarus-linked compromise of the **`axios`** JavaScript library, while **Andariel** resurfaced in South Korea using **TigerRAT** and attempting ransomware deployment. Russia-aligned groups remained heavily focused on Ukraine, with **Sednit** targeting military and drone-related entities and **Sandworm** escalating destructive operations, including a December 2025 incident at a Polish energy company attributed with medium confidence. ESET also documented browser-in-the-browser phishing against a Japanese think tank, **Asin** Android spyware targeting Arabic-speaking users, and the compromise of a UAE defense company through a **SmartOffice CRM** server.
Jun 29, 2026