GoKawiilAfter years of mysteriously shunning custom malware, Russia's infamous Sednit threat group is back to using a bespoke toolkit in recent cyber espionage campaigns targeting Ukrainian cyber assets.
At the toolkit's core are two implants, one of which employs techniques from a malware framework that Sednit used back in the 2010s, while the other is a heavily modified open source malware for long-term spying.
A New Toolkit
Researchers at ESET uncovered the malware when investigating a breach in Ukraine that happened in 2024 and involved the use of a keylogger called SlimAgent that was also based on Sednit code from more than 10 years ago. Alongside the keylogger, ESET discovered another malware implant it is tracking as BeardShell that allows the attacker to execute PowerShell commands on compromised systems while using the legitimate cloud service Icedrive for command-and-control (C2) communications.
Related:Middle East Conflict Highlights Cloud Resilience Gaps
Further investigation showed Sednit using Beardshell in concert with Covenant, a sophisticated, heavily reworked version of an open source implant supporting a range of capabilities including data exfiltration, lateral movement, and target monitoring. The malware, ESET discovered, has become Sednit's espionage tool of choice, with Beardshell acting as more of a backup in situations where a victim might discover Covenant.
"The main takeaway is that Sednit has returned with renewed malware development and is once again running sophisticated cyber-espionage campaigns," says an ESET researcher, who did not want to be named.
For defenders, the key lesson is that the group now combines custom implants with legitimate cloud services for command-and-control, making their activity harder to detect through traditional network monitoring, the researcher says. "In addition, taking down their cloud infrastructure is complicated because they deploy a pair of implants in parallel, each relying on a different cloud provider." While the current targets appear to be Ukrainian military personnel, the group could broaden its focus, depending on how Russia's war in Ukraine evolves, the researcher adds.
Sednit, tracked variously as Fancy Bear, APT28, Forest Blizzard, and Sofacy, is a threat actor that US authorities and others have linked to the intelligence directorate of the Russian military. The group has been active since 2004 and is associated with a long list of campaigns, the most notorious of which include attacks on the Democratic National Committee in 2016, the German Parliament in 2015, the World Anti-Doping Agency, and, more recently, multiple logistics and IT firms.
Related:EU Auto Rules Shift Gears on Cybersecurity Standards
... continue reading