icedrive

Reported Context (1)

On the highest-priority targets, APT28 escalates to BeardShell, a custom C++ backdoor that uses the icedrive cloud API for C2. The implant is built to swap cloud providers easily, which matches what we observed in APT28’s Tradecraft Evolves from X-Agent to LLM-Driven Malware

CVE (2)

Malware (16)

People (1)

Threat Actors (35)

Vendors (1)

Products (17)

Tools (4)

Industries (8)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.