Russia's Unit 26165 Resumes High-End Malware Campaigns

Unit 26165 (APT28) has resumed high-end malware operations since 2024, deploying custom implants (Covenant, SlimAgent, BeardShell, NotDoor) for long-term espionage primarily against Ukrainian military personnel and European maritime/transport targets across Poland, Slovenia, Turkey, Greece, UAE and Ukraine. ESET and CERT‑UA report Covenant modifications, infections dating back at least six months, and exploitation of CVE-2026-21509 via phishing with cloud services (Icedrive, Filen) used for C2 and exfiltration. Implication for portfolios: elevated cyber risk should increase relative demand for cybersecurity vendors and defense contractors while raising operational and insurance exposure for impacted corporates—monitor vendor exposures, cloud-storage telemetry, and potential regulatory/incident-related costs.

Analysis

The renewed pivot by sophisticated nation-state actors back to bespoke implants changes the attack surface from “hit-and-run phishing” to persistent, high-value footholds; that implies a multi-quarter wave of remediation, forensics billings, and replacement of legacy EOL tooling across enterprises. Expect a two-phase cadence: an immediate 0–3 month spike in patch/IR-driven spend and outage risk, followed by a 3–18 month procurement cycle where buyers favor vendors that can demonstrate integrated detection + response and fast supply-chain trust controls.

Cloud storage and third-party sync services will see non-linear policy changes by enterprise security teams and regulators; small providers face de-listing or conditional whitelisting (MFA, enterprise telemetry) which fractures the mid-market supply chain and creates arbitrage for incumbents who can offer enterprise-grade controls. That creates a sustainable TAM expansion for security telemetry, SOAR and managed detection (high gross margins) but compresses margins for small IaaS/object store plays that cannot meet audit/SLAs.

Microsoft’s position is nuanced: as both a primary target vector and a dominant provider of endpoint/Office/Cloud security, it is likely to capture a portion of accelerated spend even as reputational and customer churn risks rise in the near term. The largest reversals would come if major enterprises mandate third-party fallback tools or if regulators force changes to default telemetry/third-party app integrations — outcomes that would take 6–24 months to crystallize and create episodic volatility.

Key Decisions for Investors

• Pair trade (6–12 months): Long CRWD (CrowdStrike) 1.5% portfolio weight / Short MSFT 1.0% weight. Rationale: capture secular uplift in EDR/MDR spend while hedging cloud/Office exposure. Target: +40% upside on CRWD vs -15% downside; stop-loss pair if spread performance < -10% after 3 months.
• Long PANW (Palo Alto Networks) 2% position (12–18 months): Buy shares or call spread to limit capital outlay. Rationale: durable ASP expansion from NGFW + cloud security attach; expect 20–35% upside with ~20% downside if macro slows. Trim into +25% gain.
• Short-dated MSFT hedges (0–6 months): Buy MSFT 3–6 month 2–3% OTM put spreads (sell nearer OTM to finance). Rationale: protect portfolio from headline-driven drawdowns tied to fresh exploits and enterprise churn. Target cost ~1.0–2.0% of notional for ~6–12% downside protection; roll or liquidate on patch adoption signals.
• Long managed security services / SOC names (6–12 months): Accumulate smaller-cap MSS providers or ETFs focused on cybersecurity services (1–2% combined). Rationale: forensic/retainer revenue is sticky and re-rates faster than product-only vendors. Risk: narrow client concentration; cap gains take 6–12 months to realize.