CovenantTool
Covenant is a multi-platform command and control framework written in. NET. While designed for penetration testing and security research, the tool has also been used by threat actors such as HAFNIUM during operations. Covenant functions through a central listener managing multiple deployed "Grunts" that communicate back to the controller.From MITRE ATT&CK
Last reported 4 months ago, by Sekoia.io9 reports
ATT&CK techniques
6 of 53 · each with the sentence it comes from- T1056.001Keylogging
“T1056.001”
- T1071.001Web Protocols
“T1071.001”
- T1546.015Component Object Model Hijacking
“T1546.015”
- T1027Obfuscated Files or Information
“T1027”
- T1059.001PowerShell
“T1059.001”
- T1059.005Visual Basic
“The infection begins with Visual Basic macros embedded in the Word documents.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“The infection chain stages a customised Covenant framework deployment in memory.”
-
From APT28 to RePythonNET: automating .NET malware analysis“The APT28 Covenant sample used randomized symbol names and encrypted strings, making manual reversing tedious rather than difficult.”
-
APT28 Operation Phantom Net Voxel: BeardShell & Covenant“APT28 Operation Phantom Net Voxel: BeardShell & Covenant”
-
Reporte de Actividad APT del cuarto trimestre de 2025 al primero de 2026“Sednit desplegó sus implantes Covenant y BeardShell contra personal militar ucraniano, fabricantes de drones y organizaciones involucradas en investigación y desarrollo de drones, al tiempo que también apuntó a empresas de logística y transporte…”
-
ESET APT Activity Report Q4 2025–Q1 2026“Sednit deployed its Covenant and BeardShell implants against Ukrainian military personnel, drone manufacturers, and organizations involved in drone research and development, while also targeting logistics and transportation companies outside Ukraine.”
-
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities“It is comprised of a dropper (PrismexDrop), a steganography loader (PrismexLoader), and a Covenant Grunt implant (PrismexStager).”
-
Sednit recargado: un APT histórico reactiva su arsenal“…desarrollo avanzado de Sednit ha reaparecido con un conjunto de herramientas moderno centrado en dos implants emparejados, BeardShell y Covenant, cada uno utilizando un proveedor de nube distinto para asegurar resiliencia.”
-
Sednit reloaded: Back in the trenches“…ince April 2024, Sednit’s advanced development team has reemerged with a modern toolkit centered on two paired implants, BeardShell and Covenant, each using a different cloud provider for resilience.”
-
APT28 Leverages CVE-2026-21509 in Operation Neusploit“We analyze the capabilities of the resulting tools, including MiniDoor, PixyNetLoader, and a Covenant Grunt implant, along with their command-and-control (C2) communications.”
Indicators in its reports
named in the reports above- wellnesscaremed[.]comin 2 reports
- gateway.filen[.]netin 2 reports
- gateway.filen-1[.]netin 2 reports
- gateway.filen-6[.]netin 2 reports
- egest.filen[.]ioin 2 reports
- ingest.filen[.]ioin 2 reports
- d0db619a7a160949…151bf9775c32in 2 reports
- 99b454262dc26b08…82a49d334e5ein 2 reports
- 5603e99151f8803c…4d071542f01bin 2 reports
- 6d39f49aa11ce057…9bae423ce3d5in 2 reports
Copy these 10 indicators · defanged
Thanks — we review every report.