APT28 deployed the X-Agent implant on a compromised system, executing malware to maintain access and collect data. EDR detected the execution of a suspicious binary associated with known APT28 activities.