APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military

ESET analysis describes APT28 (a Russian GRU-linked group) deploying BEARDSHELL, COVENANT, and SLIMAGENT since 2024 to conduct long-term surveillance of Ukrainian military targets; the report highlights malware capabilities (keylogging, screenshots, PowerShell execution), use of cloud storage services for command-and-control (Icedrive, Filen, previously pCloud/Koofr), reuse of XAgent code and rare obfuscation techniques linking these implants to APT28’s custom arsenal.