Know What's Happening in Defense

This Spy Tool Has Been Quietly Stealing Data for Years

ESET researchers have uncovered a renewed Sednit campaign that relies on a dual‑implant architecture—BeardShell and the open‑source framework Covenant—each hosted on separate cloud providers for redundancy. The toolkit has been used to conduct long‑term surveillance of Ukrainian military personnel since at least April 2024, building on earlier implants such as SlimAgent and Xagent that date back to 2018. Sednit, linked to the Russian GRU’s Unit 26165, leverages Icedrive cloud storage as a covert command‑and‑control channel and adapts Covenant for data exfiltration and network pivoting. The findings illustrate a sophisticated, resilient espionage operation that has persisted for over a decade.