ESET Research: One of Russia’s most notorious groups, Sednit, resurges with spyware in Ukraine

ESET attributes a reactivation of the Sednit/GRU-linked espionage group to an April 2024 operation (SlimAgent keylogger) and documents continued paired deployments of BeardShell and Covenant across 2025–2026 targeting Ukrainian military personnel. BeardShell leverages Icedrive for C2 and was heavily reworked for long-term surveillance, while Covenant (an open-source .NET framework with >90 built-in tasks) is deployed alongside it using different cloud providers for resilience; DOJ previously linked Sednit to Unit 26165 in 2016.

Analysis

Adversaries are increasingly building resilience by multiplexing benign cloud services and community tooling into multi-vector persistence stacks, which shifts the detection problem from signature matching to cross-tenant behavioral telemetry and long-window correlation. That raises the economic value of platforms that already ingest cloud-native logs and host-based signals at scale, and conversely increases remediation costs for customers who must now normalize multi-cloud telemetry and retain it for months to meet detection windows.

Expect regulatory and contractual second-order effects: regulators will press cloud providers and niche storage vendors for faster takedown and richer audit logs, driving new compliance features and higher unit costs for hosting/ingestion. Over 6–24 months this will compress margins for smaller cloud/storage providers and boost recurring revenue for SIEM/XDR vendors that offer turnkey, auditable pipelines and managed detection for multi-cloud environments.

Tail-risks are asymmetric and concentrated in policy and disclosure: a high-profile exploit that successfully weaponizes common cloud APIs at scale could prompt temporary bans, new data-locality mandates, or mandatory telemetry retention rules—each capable of moving budgets from cloud growth to security and compliance in weeks. The immediate reversion scenario is also clear: if cloud providers adopt lightweight, behavioral C2 detection primitives and takedown playbooks within 3–6 months, the short-term premium on security vendors could retrace sharply, favoring names with demonstrated engineering partnerships to implement those controls.

Key Decisions for Investors

• Long Palo Alto Networks (PANW), 12–18 months. Rationale: market leader in network + cloud enforcement; asymmetric upside (30–50%) if enterprise spending pivots to preventative cloud controls. Size 3–5% of security sleeve; tactical stop-loss 18% below entry; consider buying 12‑month calls to lever 2–3x exposure with capped downside.
• Long CrowdStrike (CRWD), 6–12 months. Rationale: pure-play endpoint/cloud-native telemetry specialist best positioned to monetize longer dwell-time detection; target 25–40% upside on durable ARR expansion. Position 3–5%; hedge with 1–2% notional in out-of-the-money puts to protect vs broad risk-off.
• Long Splunk (SPLK) or Splunk calls, 9–12 months. Rationale: SIEM/observability consolidation winner as customers centralize cross-cloud logs; revenue leverage as retention and ingestion prices rise. Size 2–4%; catalyst: enterprise deals and new cloud ingestion partnerships—take profits if guidance disappoints or if cloud providers internalize detection.
• Tactical pair: long CRWD / short Check Point Software (CHKP), 6–12 months. Rationale: prefer cloud-native EDR/XDR over appliance/perimeter incumbents for this multi-cloud detection regime. Aim for 1.5–2x exposure on the long leg versus short leg, with stop-loss on pair if spread narrows by 20%.