Covenant — Malware Profile
Covenant is a multi-platform command and control framework written in .NET. While designed for penetration testing and security research, the tool has also been used by threat actors such as HAFNIUM during operations. Covenant functions through a central listener managing multiple deployed "Grunts" that communicate back to the controller.
MITRE ATT&CK techniques (10)
- T1047 Windows Management Instrumentation
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1218.004 InstallUtil
- T1218.005 Mshta
- T1218.010 Regsvr32
- T1571 Non-Standard Port
- T1573.002 Asymmetric Cryptography
IntelFusions coverage
- APT28 Weaponizes CVE-2026-21509 Zero-Day in Operation Neusploit Targeting Eastern Europe 2026-02-02
- CERT-UA Issues Danger Bulletin as APT28 Exploits CVE-2026-21509 Against Ukraine and EU Governments 2026-02-01