APT28’s BeardShell Campaign: Steganography, Cloud Abuse, and Persistent Espionage

The article, published on 17 September 2025, reports that the Russian‑linked threat actor APT28, also known as Sofacy, Fancy Bear, Forest Blizzard and TAG-110, has unveiled a new wave of cyber‑espionage in 2025 targeting Ukrainian military administration and command structures. According to Sekoia[.]io’s Threat Detection & Response (TDR) team, the operation blends steganography, open‑source tools and cloud‑based command‑and‑control to support its activities.

The infection chain begins with weaponised Office documents delivered through private Signal chats, containing malicious VBA macros that perform COM hijacking to load prnfldr.dll, which secretly extracts hidden shellcode from a PNG image. The shellcode loads the Covenant framework’s GruntHTTPStager to establish covert communications via the Koofr cloud service, and the operation deploys BeardShell, a C++ backdoor that uses icedrive as its C2 channel and polls its icedrive directory every four hours for commands.

BeardShell executes PowerShell commands or scripts triggered by operator‑issued files, with results uploaded back to icedrive disguised as image files. The campaign also involves SlimAgent, a spyware implant capable of keylogging, screenshots and clipboard theft, and marks a broader shift toward abusing legitimate cloud services to mask malicious activity.