icedrive

Reported Context (1)

On the highest-priority targets, APT28 escalates to BeardShell, a custom C++ backdoor that uses the icedrive cloud API for C2. The implant is built to swap cloud providers easily, which matches what we observed in Sekoia Traces APT28’s Tradecraft Evolution From X-Agent to LLM-Driven Malware

CVE (2)

Malware (15)

Threat Actors (20)

MITRE ATT&CK (11)

Vendors (8)

Products (12)

Tools (5)

Industries (7)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.