Cyberinsider

APT28 Revives Advanced Malware Toolkit for Cyber-Espionage

First seen 10 Mar 2026, 10:57 UTC • Therecord.Media

+4 •65.4

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

APT28, a Russian threat actor, has reactivated its malware development team and deployed a modern espionage toolkit that includes a customized version of the Covenant open-source tool. This resurgence indicates a renewed focus on cyber-espionage operations, potentially impacting various organizations targeted by state-sponsored hacking efforts.

How this analysis works

Timeline

2026-03-10

APT28 reactivates malware developers with new toolkit

2026-03-10

Covenant open-source tool variant deployed by APT28

Attack Flow

12 entities, 33 inferred relationships (STIX 2.1).

Threat Actor (8)

Apt28
BlueDelta
Fancy Bear
Pawn Storm
Sednit
Sofacy Group
Strontium
Uac-0001

Technique (1)

Malware

Organization (1)

Ukrainian Military

Malware (1)

BeardShell

Tool (1)

Covenant

Relationships

Apt28 uses BeardShell
BlueDelta uses BeardShell
Fancy Bear uses BeardShell
Pawn Storm uses BeardShell
Sednit uses BeardShell
Sofacy Group uses BeardShell
Strontium uses BeardShell
Uac-0001 uses BeardShell
Apt28 uses Covenant
BlueDelta uses Covenant
Fancy Bear uses Covenant
Pawn Storm uses Covenant
Sednit uses Covenant
Sofacy Group uses Covenant
Strontium uses Covenant
Uac-0001 uses Covenant
Apt28 uses Malware
BlueDelta uses Malware
Fancy Bear uses Malware
Pawn Storm uses Malware
Sednit uses Malware
Sofacy Group uses Malware
Strontium uses Malware
Uac-0001 uses Malware
Apt28 targets Ukrainian Military
BlueDelta targets Ukrainian Military
Fancy Bear targets Ukrainian Military
Pawn Storm targets Ukrainian Military
Sednit targets Ukrainian Military
Sofacy Group targets Ukrainian Military
Strontium targets Ukrainian Military
Uac-0001 targets Ukrainian Military
BeardShell targets Ukrainian Military

Continue Reading

APT28 Exploits MSHTML Zero-Day Vulnerability in Windows APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine GRU Compromises Home Routers in 23 States to Steal Outlook Credentials Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Critical RCE Vulnerability in Zimbra Exploited by Attackers Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials

APT28 Revives Advanced Malware Toolkit for Cyber-Espionage

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading