APT28 Revives Advanced Malware Toolkit for Cyber-Espionage

Cyberinsider

APT28 Revives Advanced Malware Toolkit for Cyber-Espionage

First seen 10 Mar 2026, 10:57 UTC • •65.4

Article Content

1 / 10

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

APT28, a Russian threat actor, has reactivated its malware development team and deployed a modern espionage toolkit that includes a customized version of the Covenant open-source tool. This resurgence indicates a renewed focus on cyber-espionage operations, potentially impacting various organizations targeted by state-sponsored hacking efforts.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 228d ago How this analysis works

Timeline

2026-03-10

APT28 reactivates malware developers with new toolkit

2026-03-10

Covenant open-source tool variant deployed by APT28

More articles in this cluster (9)

Threat Graph

5 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

APT28
Fancy Bear

Technique (1)

Malware

Malware (1)

BeardShell

Tool (1)

Covenant

Relationships

APT28 uses BeardShell
Fancy Bear uses BeardShell
APT28 uses Covenant
Fancy Bear uses Covenant
APT28 uses Malware
Fancy Bear uses Malware

Following this threat?

Track APT28 and BeardShell in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

APT28 Targets NATO Defense Firms with New Hookedge Backdoor The Russian espionage group APT28, also known as Swallowtail, has targeted defense contractors in two NATO countries, including a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. The attacks utilized a new backdoor called Hookedge, which was first documented in August 2026.…

Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that…