APT28 Deploys BeardShell and Covenant Modules via Weaponized Office Documents
Security researchers at Sekoia.io have identified a complex cyberattack campaign conducted by APT28, a well-known Russian state-sponsored threat actor. This campaign targets Ukrainian military personnel using weaponized Office documents to deliver…
Security researchers at Sekoia.io have identified a complex cyberattack campaign conducted by APT28, a well-known Russian state-sponsored threat actor. This campaign targets Ukrainian military personnel using weaponized Office documents to deliver advanced malware frameworks, including BeardShell and Covenant modules.
The operation showcases an evolution in APT28's tactics, employing legitimate cloud infrastructure and new obfuscation methods to maintain persistent access while evading detection.
The malicious Office documents are distributed through Signal Desktop, which lacks the Mark of the Web (MOTW) security feature. This allows macros to execute without triggering standard security warnings in Microsoft Office.
The attackers impersonate colleagues or superiors in Signal chats, manipulating targets into opening the documents by creating false urgency. The documents appear legitimate, featuring authentic Ukrainian military forms.
Sekoia researchers accessed compromised accounts and found 115 files across multiple folders, with unique partial GUIDs indicating at least 42 different compromised hosts. The earliest infection was recorded on Wed, Dec 3, 2024.
Once macros are enabled, the Visual Basic script in the Office document initiates a multi-stage infection process. It verifies the Windows OS and VBA version, switches to Print Layout view, and deobfuscates hidden data.
Security researchers at Sekoia.io have identified a complex cyberattack campaign conducted by APT28, a well-known Russian state-sponsored threat actor.
Persistence is established by adding a registry entry that hijacks the Windows Printer COM server, loading a malicious DLL automatically. The infection chain drops two critical files: prnfldr.dll and windows.png , utilizing steganographic techniques to extract a shellcode payload.
The payload initializes the Common Language Runtime environment to load a .NET executable, part of the Covenant framework, a red team tool. APT28 has customized this framework with a C2Bridge implementation using the Koofr cloud service for command and control communications.
The Covenant framework downloads additional components, including PlaySndSrv.dll and sample-03.wav , which extract and execute BeardShell, a C++ backdoor using icedrive cloud storage for command and control.
BeardShell generates identifiers for each infected host and uploads results to icedrive. It polls the directory every four hours for new commands, enabling operators to manage multiple sessions and execute PowerShell scripts.
To evade detection, uploaded files are encrypted with the ChaCha20-Poly1305 algorithm and disguised with image file headers.
APT28, also known as Sofacy, Fancy Bear, and other aliases, is linked to Russia's GRU. The campaign demonstrates significant technical advancements, integrating open-source security tools with third-party cloud services for covert communications.
The use of steganography to embed payloads inside PNG files is a novel obfuscation method for APT28. Sekoia's team confirmed that APT28 reused this infection chain in August 2025, targeting the Filen cloud environment, indicating ongoing adaptation of these techniques.
Based on reporting by GBHackers.