APT28 Operation Phantom Net Voxel: BeardShell & Covenant

Sekoia.io TDR describes a sophisticated APT28 campaign targeting Ukrainian military administrative personnel using Signal-delivered weaponized Office documents. The infection chain uses VBA macros to install a proxy COM DLL that extracts AES-encrypted shellcode from PNG images, initializes the CLR to load a Covenant Grunt stager communicating via Koofr, and ultimately enables deployment of a BeardShell backdoor (icedrive C2) and SlimAgent spyware; the report includes detailed technical analysis, IOCs (hashes, YARA rules), and scripts to detect or decrypt artefacts.