SlimAgent
SlimAgent is a spyware/keylogging implant associated with the Russian state-sponsored threat actor APT28, also tracked as Sednit and Fancy Bear. It was discovered on a Ukrainian government system in 2024, and reporting indicates it has been used in espionage operations targeting Ukrainian government and military-related entities. ESET assessed that SlimAgent likely evolved from APT28’s older XAgent/Xagent codebase, with related samples dating back to at least 2018 and code similarities including keylogging logic and matching HTML-formatted logging conventions.
High-confidence capabilities described in the source material include keystroke logging, clipboard collection, screenshot capture, and mouse tracking. Reporting also states that SlimAgent captures screenshots via Windows APIs, encrypts screenshots with AES and RSA, and stores them locally using timestamped filenames. It has been described as a simple but effective spying tool and as a standalone espionage implant.
SlimAgent has been observed alongside other APT28 tooling, particularly BeardShell, and was found with BeardShell on an APT28-controlled command-and-control server previously investigated by CERT-UA. CERT-UA publicly documented SlimAgent in June 2025, and separate reporting states that Signal chats were exploited to deliver BeardShell and SlimAgent to Ukrainian government organizations. SlimAgent is also referenced in broader APT28 activity clusters including Operation Phantom Net Voxel. Indicators and traits directly mentioned in the content include its use as a C++ malware tool, local storage of encrypted screenshots with timestamped filenames, and historical internal naming/codebase overlap with RemoteKeyLogger.dll/XAgent-derived functionality.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The two pieces of malware have been used recently to target central executive bodies of Ukraine in attacks that exploited the CVE-2026-21509 vulnerability in Microsoft Office via malicious DOC files.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Exatrack also identified two other APT28 tools: SlimAgent and Graphite.
The researchers uncovered these malware families after discovering SlimAgent, a keylogging implant deployed in a Ukrainian government system capable of keystroke capture, clipboard collection, and screenshot capture.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
“Sednit typically compromises its targets through social engineering over Signal Desktop or WhatsApp Desktop, persuading them to open Trojanized Excel or Word documents. In some cases, the attackers even call their targets to increase the chances of success.”
Execution
3 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
1 technique
Credential Access
Collection
4 techniques
Collection
"BeardShell, Covenant, and SlimAgent collect data from a compromised machine."
ESET researchers traced the reactivation of Sednit’s advanced implant team to a 2024 case in Ukraine, where a keylogger named SlimAgent was deployed.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An APT28-associated tool identified through shared binary characteristics and code packaging habits linked to PixyNetLoader investigations.
A keylogger used by Sednit in Ukraine; its code was derived from Xagent.
Keylogger used alongside BeardShell and Covenant in the campaign; assessed as an evolution of APT28’s older XAgent tooling.
An espionage implant written in C++ that captures screenshots, encrypts collected data with AES and RSA, and stores it locally; researchers assess it likely evolved from XAgent and has been deployed as a standalone espionage tool since at least 2018.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.