APT28 Exploits Signal Messenger to Deploy eardShell and Covenant Malware

On September 16, 2025, GBHackers reported on a sophisticated cyber campaign by APT28, which exploits Signal Messenger to deploy two new malware families: BeardShell and the Covenant framework. The campaign begins with spearphishing attacks using malicious Office documents sent through Signal, which contain VBA macros that hijack COM to load malicious DLLs. APT28, linked to Russia's GRU, has been active in various cyber operations, including targeting military personnel in conflict zones.

The investigation revealed advanced techniques such as cloud-based command and control (C2) communications and steganography, indicating a significant evolution in APT28's tactics. The report emphasizes the need for ongoing monitoring and detection refinement to counter these threats.