APT28 With Weaponized Office Documents Delivers BeardShell and Covenant Modules
In mid-2025, APT28 initiated a spear-phishing campaign utilizing weaponized Office documents to deploy two new payloads: BeardShell, a C-based backdoor, and Covenant’s HTTP Grunt Stager. BeardShell employs IceDrive for command-and-control, while the…
In mid-2025, APT28 initiated a spear-phishing campaign utilizing weaponized Office documents to deploy two new payloads: BeardShell, a C-based backdoor, and Covenant’s HTTP Grunt Stager. BeardShell employs IceDrive for command-and-control, while the Covenant Stager uses the Koofr cloud API for communication.
The campaign involves distributing malicious documents through private Signal chats. These documents bypass Microsoft Office security by exploiting the absence of Mark-of-the-Web protection.
The campaign targets users with documents that resemble internal legal or administrative notifications, urging them to open embedded files containing macros. When opened, these documents execute a VBA macro that performs environment checks, deobfuscates payloads, and establishes persistence.
As noted by Sekoia analysts, the primary macro conducts a COM hijack by placing a DLL (prnfldr.dll) and a benign-looking PNG file (windows.png) in the system. The macro registers the DLL under the CLSIDPrinters registry key and uses regsvr32.exe to initiate the DLL's installation routine, ensuring execution without reboot.
Once activated by Explorer.exe, prnfldr.dll proxies print functions and initiates a secondary thread to extract AES-encrypted shellcode from the PNG file. This method embeds metadata, a key, IV, and encrypted content within the image data.
BeardShell employs IceDrive for command-and-control, while the Covenant Stager uses the Koofr cloud API for communication.
Decryption of the shellcode initializes the Common Language Runtime and loads the Covenant .NET assembly, establishing an HTTP-based C2 channel with Koofr infrastructure.
The secondary stage employs digital steganography to read the PNG file, extract the payload, and execute the Covenant Grunt Stager:
HRESULT hr; ICLRMetaHost pMetaHost = NULL; pMetaHost->GetRuntime(L"v4.0.30319", IID_ICLRRuntimeInfo, (LPVOID)&pRuntimeInfo); pRuntimeInfo->GetInterface(CLSID_CorRuntimeHost, IID_ICorRuntimeHost, (LPVOID*)&pCorRuntimeHost); pCorRuntimeHost->Start(); pCorRuntimeHost->ExecuteInDefaultAppDomain(L"C:\\path\\GruntHTTPStager.dll", L"EntryPoint", L"Execute", NULL, &hr);
Through Koofr’s API, Covenant’s HTTP Grunt module uploads reconnaissance data and downloads new modules using hybrid encryption for session keys.
BeardShell operates as a C DLL, loading the System.Management.Automation assembly. It interfaces via JSON for PowerShell commands, polling an IceDrive directory every four hours for command execution.
{"taskid":0,"cmdid":2,"data":{"id":0,"cmd":"ipconfig /all"}}
This dual-payload strategy highlights APT28's use of open-source frameworks and cloud services for covert operations. Embedding steganographic payloads and using multiple cloud channels complicates detection, emphasizing the need for advanced steganography detection and cloud API monitoring.
Based on reporting by Cyber Security News.