APT28 Leverages Signal for BEARDSHELL and COVENANT Malware Deployment in Ukraine

TL;DR

The Russia-linked APT28 group is utilizing Signal chat messages to deliver BEARDSHELL and COVENANT malware in Ukraine. BEARDSHELL, written in C++, can execute PowerShell scripts and upload results, while COVENANT is a .NET-based C2 framework. This campaign highlights the evolving tactics of cyber threats in geopolitical conflicts.

APT28’s New Cyber Attack Campaign in Ukraine

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a warning about a sophisticated cyber attack campaign orchestrated by the Russia-linked APT28 group, also known as UAC-0001. This campaign leverages Signal chat messages to deploy two new malware families: BEARDSHELL and COVENANT.

BEARDSHELL Malware

BEARDSHELL, as reported by CERT-UA, is a malware written in C++. Its capabilities include:

• Downloading and executing PowerShell scripts.
• Uploading the results of executed scripts.

This malware demonstrates the advanced techniques used by APT28 to infiltrate and control targeted systems.

COVENANT Malware

COVENANT is a .NET-based command and control (C2) framework that enhances the attackers’ ability to maintain persistent access to compromised systems. It provides a range of functionalities, including:

• Executing arbitrary commands.
• Manipulating files and directories.
• Collecting system information.

Implications and Future Threats

The use of Signal chat messages to deliver malware underscores the evolving tactics of cyber threat actors. As geopolitical tensions rise, cybersecurity measures must adapt to counter these sophisticated attacks. Organizations and individuals in Ukraine and beyond should remain vigilant and implement robust security protocols to protect against such threats.

For more details, visit the full article: source

Conclusion

The deployment of BEARDSHELL and COVENANT malware via Signal chat messages by APT28 highlights the ongoing cybersecurity challenges in Ukraine. As cyber threats continue to evolve, it is crucial for stakeholders to stay informed and proactive in their defense strategies. This incident serves as a reminder of the importance of cybersecurity in modern conflicts.