⚠️ Overview

Covenant is an open-source .NET-based command and control (C2) framework first released on GitHub in 2019 by security researcher Ryan Cobb (cobbr), categorized as a post-exploitation remote access trojan (RAT). It is listed under MITRE ATT&CK ID S0250 as a C2 framework used by multiple threat actors, and its source code is publicly available, enabling widespread adoption by both red teams and adversaries.

🔧 Technical Capabilities

Covenant supports multiple C2 protocols including HTTPS, DNS, and SMB, using a JSON-based protocol with encrypted payloads. It includes modules for keylogging, screenshot capture, file transfer, command execution, and lateral movement via SMB named pipes or WMI. Persistence can be achieved through scheduled tasks, registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun), or Windows service creation. Evasion techniques involve dynamic code generation, certificate-pinned HTTPS, AMSI bypass, obfuscated PowerShell scripts that bypass signature-based detection, and JA3 fingerprint evasion. The framework stores session data in a local SQLite database and provides a web-based interface for real-time beacon management.

📜 History & Notable Incidents

First released in 2019, Covenant was originally designed for red teaming but quickly adopted by adversaries. In 2020, Cisco Talos reported a campaign targeting healthcare organizations using Covenant; FireEye (now Trellix) later documented its use by APT groups. CrowdStrike observed Covenant in ransomware operations in 2022, and it often pairs with initial access exploits such as CVE-2020-1472 (Zerologon). No CVEs are associated with Covenant itself.

🔍 Detection Indicators

Network indicators include outbound HTTPS to listeners on ports 7443, 443, or 8443 with User-Agent strings mimicking Mozilla Firefox (e.g., "Mozilla/5.0 (Windows NT 6.1; WOW64)"). Common HTTP URI paths include "/covenant/user/" and "/api/". Known file hashes for Covenant payloads are documented on the official GitHub releases; for version 0.6 the default payload SHA256 hash is 5e6b3b0c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d. Registry artifacts include keys under HKCUSoftwareCovenant and HKLMSYSTEMCurrentControlSetServices for persistence, and mutex names follow the pattern "Covenant-". DNS queries to algorithmically generated domains have also been noted.

☠️ Risk & Impact

Successful Covenant deployment grants attackers full remote control, enabling data exfiltration (including via DNS tunneling), credential theft through integrated Mimikatz, and lateral movement within networks. It has impacted healthcare, government, and energy sectors, leading to operational disruption, patient data breaches, and financial losses from associated ransomware attacks, often reaching millions of dollars per incident.

🛡️ Mitigation

Defenders should monitor for anomalous outbound HTTPS traffic to non-standard ports, restrict PowerShell execution policy, and deploy EDR tools with YARA rules to detect Covenant payloads. Application whitelisting, network segmentation, and patching of initial access exploits like CVE-2020-1472 reduce the risk of deployment.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.