APT28 Deploys BeardShell and Covenant Modules via Weaponized Office Documents

Security researchers have detailed a campaign attributed to APT28 that targets Ukrainian military personnel with weaponized Office documents delivering BeardShell and Covenant modules, marking a significant evolution in the group’s techniques. The infection chain begins with macros in the weaponized documents, distributed through Signal Desktop, chosen for its lack of MOTW, enabling macro execution from untrusted sources.

Sekoia[.]io researchers found 115 files across multiple folders and 42 unique partial GUIDs, dating the earliest infection to 3 December 2024. Beacons drop two components, a prnfldr.dll proxy and a stealthy Windows PNG containing steganographically extracted shellcode that loads Covenant’s HTTP Grunt Stager and, later, BeardShell via a .NET executable, with Koofr-based cloud storage used for C2 communications.

According to CERT-UA’s analysis confirmed by Sekoia, the Covenant framework can download additional components and integrates a PowerShell execution capability, while BeardShell encrypts data and uses icedrive for command‑and‑control. The attackers’ use of steganography and cloud services reflects a marked advancement in evading detection while enabling persistent access.