Covenant is a tool tracked by ThreatCluster, appearing in 6 threat clusters built from 17 intelligence report mentions.
Covenant is a tool tracked across 6 threat clusters and 17 intelligence report mentions on ThreatCluster. First observed February 2, 2026; most recent activity May 28, 2026.
Russian cyber group APT28, also known as Fancy Bear, has been exploiting vulnerabilities in TP-Link and MikroTik routers to conduct large-scale DNS hijacking operations. This campaign, which has affected over 18,000…
ESET's latest APT Activity Report reveals that from October 2025 to March 2026, China-aligned threat actors engaged in extensive espionage campaigns, particularly in Venezuela and the Gulf region. Following U.S.…
Xu Zewei, a 33-year-old Chinese national, was extradited from Italy to the United States on April 27, 2026, following his arrest in Milan on July 3, 2025. He is accused of participating in cyberattacks directed by the…
APT28, a Russian threat actor, has reactivated its malware development team and deployed a modern espionage toolkit that includes a customized version of the Covenant open-source tool. This resurgence indicates a…
ESET researchers have identified the resurgence of the Sednit group, a notorious Russian cybercriminal organization, linked to the deployment of a keylogger named SlimAgent in Ukraine. This activity is traced back to a…
CERT-UA has reported a new wave of cyberattacks targeting Ukrainian government agencies and EU organizations, exploiting the Microsoft Office vulnerability CVE-2026-21509. Attackers are using malicious emails disguised…
Covenant is a tool tracked by ThreatCluster, appearing in 6 threat clusters built from 17 intelligence report mentions.
The most recent intelligence report mentioning Covenant on ThreatCluster is dated May 28, 2026. Activity was first observed February 2, 2026, giving a tracked span from then to May 28, 2026.
Across ThreatCluster reporting, Covenant most frequently co-occurs with Andariel, Apt28, BlueDelta, DeceptiveDevelopment, FamousSparrow, among 12 tracked related entities.
The most significant recent cluster is “APT28 Exploits Vulnerable Routers for Global DNS Hijacking Campaign” (100 articles · Updated April 7, 2026). Covenant appears across 6 threat clusters in total, listed above with sources.
Covenant appears in 17 intelligence report mentions across 6 deduplicated threat clusters, aggregated from 17,000+ monitored sources.