iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ukraine’s CERT-UA reported that a campaign targeting government agencies used Signal to deliver a malicious Word document. If a recipient opened the document and enabled its embedded macro, the infection chain could load COVENANT, abuse Koofr’s cloud-service API to receive commands, and deploy the BEARDSHELL backdoor. CERT-UA associated the activity with UAC-0001 (APT28) and said the attackers sought remote access for espionage and data theft.
How the reported attack worked
In its 1 July 2025 account, Ukraine’s CERT-UA described a sequence that depended on a recipient opening a document and activating its macro. The example filename was “Act.doc.”
- Delivery through Signal: An attacker sent a targeted Microsoft Word document to a recipient through the messaging app. The report identifies Signal as the delivery channel; it does not say that Signal itself was compromised.
- Macro activation: The document contained an embedded macro. According to CERT-UA’s summary, the recipient had to open the document and enable the macro to trigger the hidden infection mechanism.
- COVENANT contacts Koofr: A COVENANT component ran in memory and used the legitimate Koofr cloud service’s API to receive commands.
- BEARDSHELL is deployed: COVENANT downloaded and launched BEARDSHELL, which CERT-UA described as the main spyware/backdoor in the chain and as giving attackers control of the affected computer.
Koofr is described in the report as an abused service used for command receipt—not as the attacker or malware author. CERT-UA’s public summary does not establish that every component was newly discovered or first used in this campaign, so “BEARDSHELL backdoor” is more precise than calling it entirely new malware.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What BEARDSHELL was intended to do
CERT-UA described the objective as obtaining remote access to computers for espionage and data theft. That states the attackers’ goal; the public summary does not quantify stolen data or detail consequences for named victims.
#1 Best Overall
- Compatible with iPhone, iPad and android devices (requires IOS 7+ or android 4.4+ with Bluetooth 4.0+)
- Constant monitoring for high/low pressure, slow leak, rapid leak, high temperature and blowouts
- Monitors up to 22 tires (0-232 psi) with simultaneous pressure and temperature readings
- Features auto-scroll, auto-search, two-part disconnect and other advanced TPMS functions
- Includes Tire Minder Bluetooth adapter and rhino signal booster for superior signal strength
Who CERT-UA attributed the activity to
CERT-UA associated the campaign with UAC-0001 (APT28), which it said is controlled by Russian special services. The agency summary does not state an attribution-confidence level. It identifies government agencies as targets but does not name individual agencies or provide a victim count.
What to do with a suspicious document
CERT-UA relayed this advice from Ukraine’s State Service of Special Communications and Information Protection: “Be vigilant, do not open suspicious files and do not enable macros in documents received even through instant messengers.”
Rank #2
- Complete Privacy Protection: Blocks all signals to prevent tracking, data leaks, and remote activation
- Fits 6.5-Inch Phones: Compatible with most smartphones including latest iPhones and Android devices
- Anti-Radiation Shield: Nano-shielding fiber lining reduces EMF exposure for pregnant women and daily users
- Multi-Scene Use: Essential for cars, hotels, bathrooms, meetings, and sensitive locations
- Visible Effectiveness: Test-proven No Service status when phone is enclosed
- Do not open a document you were not expecting, even if it arrives through a familiar messaging app.
- Do not enable macros in a suspicious document. A request to enable them is not proof of malicious activity, but it is a reason to stop and verify the file through a trusted channel.
- If you suspect an incident, follow the current reporting instructions and contact details on the official CERT-UA notice.
What the public account does not establish
The CERT-UA summary does not provide indicators of compromise, a list of affected agencies, the number of victims, a confirmed amount of data loss, or an independently stated confidence level for attribution. Those details should not be inferred from the attack sequence alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
