Science & Tech · Cybersecurity · 1 hr ago
Russia-linked APT28 targeted defense and law enforcement groups in two NATO countries
Russia-linked hacking group APT28 targeted organizations in two NATO countries in a cyber-espionage campaign, researchers say.
The victims included a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in Europe; their countries and names have not been disclosed.
The hackers used a backdoor called HOOKEDGE to access systems, steal credentials and gather information about networks.
At the shipbuilder, they repeatedly returned to a compromised computer, opened a route into the company's internal network and deployed a previously unknown tool that runs code in the computer's memory.
The tool's purpose and any stolen data remain unknown, though researchers say defense-related information may have been a goal.
Activity was detected through September 24, after a first confirmed infection on July 24, but researchers could not establish whether the hackers had continuous access.
Researchers say the later activity suggests the campaign may still be ongoing.
APT28, a Russia-linked hacking group, targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two NATO countries.
Researchers at Symantec attributed the espionage campaign to APT28 and said the victims were in Europe.
The attackers used the HOOKEDGE backdoor to access systems and steal credentials, and deployed a previously undocumented loader at the shipbuilder.
The first confirmed infection at the shipbuilder was on July 24, 2026, and related activity was detected as late as September 24.
Researchers could not determine whether the attackers stole sensitive information or maintained uninterrupted access throughout the period.
- Who
- APT28, a Russia-linked hacking group.
- What
- The group targeted defense-related companies and a law enforcement agency in an espionage campaign.
- When
- The first confirmed infection was July 24, 2026, with related activity detected as late as September 24.
- Where
- Two NATO countries in Europe; researchers did not identify the countries or organizations.
- Why
- Researchers said the target selection suggests Russian intelligence gathering. The attackers’ specific objective was not confirmed.
This story does not have two clearly opposing sides.
The first confirmed infection occurred at the naval shipbuilder.
Attackers delivered new HOOKEDGE variants in an attack on the shipbuilder.
Attackers repeatedly returned to a compromised computer and deployed a previously undocumented tool.
Related malicious activity was detected in the shipbuilder's network.
- Attributed group
- APT28, also known as Fancy Bear, BlueDelta and Forest Blizzard
- Targets
- A naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency
- Countries
- Two NATO member states in Europe; names not disclosed
- Backdoor
- HOOKEDGE
- First confirmed infection
- July 24, 2026
- Latest reported activity
- September 24, 2026
3 sources
What people are saying
Given the nature of the targets, it's reasonable to assume that defense-related information was the objective of the attacks.
In some cases, the attackers were on the network for a few weeks, which may have given them opportunities to obtain data.
During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity.
They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network and deployed a previously undocumented reflective loader.