--- title: "Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit" url: https://daily.dev/posts/russian-threat-actor-sednit-resurfaces-with-sophisticated-toolkit-rnewjohnk source_url: https://www.darkreading.com/cyber-risk/sednit-resurfaces-with-sophisticated-new-toolkit type: article source: "Dark Reading" published: 2026-03-10T20:11:47.179Z updated: 2026-03-10T20:12:11.510Z tags: ["malware"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Russia-linked threat group Sednit (APT28/Fancy Bear) has resumed sophisticated cyberespionage operations targeting Ukrainian military personnel after years of using simple implants. ESET researchers uncovered two new malware tools: BeardShell, a PowerShell interpreter that uses the legitimate cloud service Icedrive for C2 communications, and Covenant, a heavily modified open-source .NET post-exploitation framework supporting over 90 espionage functions. Both tools share code lineage with older Sednit malware from the 2010s, suggesting the same development team has continued evolving the toolkit. The group uses social engineering via Signal and WhatsApp Desktop to deliver trojanized Office documents, and their use of legitimate cloud infrastructure for C2 makes detection and blocking significantly harder. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns](https://daily.dev/posts/tracking-iranian-apt-screening-serpens-2026-espionage-campaigns-g1lvjgxxj) · Unit 42 · 0 upvotes · 0 comments - [Russia's 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses](https://daily.dev/posts/russia-s-gamaredon-upgrades-its-arsenal-requiring-new-defenses-4n9dt8v9w) · Dark Reading · 0 upvotes · 0 comments - [Iranian Infy APT Resurfaces with New Malware Activity After Years of Silence](https://daily.dev/posts/iranian-infy-apt-resurfaces-with-new-malware-activity-after-years-of-silence-6xmscslpc) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/russian-threat-actor-sednit-resurfaces-with-sophisticated-toolkit-rnewjohnk)