Tool
Covenant
- First Reported
- Feb 2, 2026
- Latest Reported
- Jun 11, 2026
Reported Context (3)
- Covenant APT28’s Tradecraft Evolves from X-Agent to LLM-Driven Malware
- entire image. It is comprised of a dropper (PrismexDrop), a steganography loader (PrismexLoader), and a Covenant Grunt implant (PrismexStager). Pawn Storm Uses PRISMEX Malware and Exploits Microsoft Office Vulnerability in Campaign Targeting Ukraine and Allies
- chain. We analyze the capabilities of the resulting tools, including MiniDoor, PixyNetLoader, and a Covenant Grunt implant, along with their command-and-control (C2) communications. APT28 Used CVE-2026-21509 to Deploy Email-Stealing and Backdoor Malware in Eastern Europe
CVE (4)
Malware (25)
People (1)
Threat Actors (35)
MITRE ATT&CK (13)
Vendors (1)
Products (21)
Tools (5)
Industries (11)
Countries (13)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.