Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit

ESET researchers report that Russia‑linked Sednit (APT28) has resumed using custom malware in 2024 espionage campaigns against Ukrainian targets, deploying two implants — BeardShell (a PowerShell‑based implant using Icedrive for C2) and a heavily modified Covenant framework — plus a SlimAgent keylogger. The group uses legitimate cloud services for command‑and‑control, frequent loader updates, and social‑engineering over messaging apps to deliver Trojanized documents, making detection and disruption more difficult.