Symantec says Russia-linked APT28 targeted a naval shipbuilder, an aircraft engine maker and a law enforcement agency in two NATO countries

TLDR

• Symantec says APT28 targeted a naval shipbuilder, an aircraft engine maker and a law enforcement agency in two NATO states.¹²
• At the shipbuilder, operators stole credentials, opened a persistent SSH tunnel and deployed a previously undocumented loader, ld.exe.¹²
• Symantec did not recover the loader's payload, and it is unclear whether any data was stolen.¹²

Symantec's Threat Hunter Team, which tracks the group as Swallowtail (also known as APT28, Fancy Bear and Forest Blizzard), says the Russian espionage group targeted organisations in two NATO member states: a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines.¹² Symantec says all three were likely to hold information of direct interest to a foreign intelligence service, and that the common thread is their relevance to national security and defence policy.¹ It notes that the US government describes the group as a unit of Russia's military intelligence agency, the GRU.¹ The sources reviewed do not name the two countries or the three organisations.

Symantec says the shipbuilder intrusion began with a malicious Word document opened on the afternoon of 24 July 2026 from the Outlook attachment cache, which dropped the Hookedge backdoor.¹ The Hacker News dates the attack to late July and says the most recent activity, a Visual Basic Script launcher associated with Hookedge, was seen in the shipbuilder's network on 24 September.² Symantec's summary describes an intrusion lasting at least two months, and separately describes operators returning to a compromised host repeatedly over about a week in what looked like hands-on-keyboard activity.¹ In that activity the attackers stole credentials by two techniques: pushing an SSH private key onto the host and using it to open a persistent tunnel from their own server into the internal network, and running a short PowerShell script that stands up a listener on the host's loopback address and forces the machine to authenticate to it, capturing the NTLM handshake.¹²

Hookedge is delivered through macro-enabled Word documents and communicates through the webhook.site service, with infected hosts fetching tasks through a hidden, off-screen Microsoft Edge instance rather than a conventional downloader.¹² Recorded Future's Insikt Group first documented the backdoor in August 2026, and CyberScoop says Insikt saw the same group using it from September 2025 against defence and diplomatic targets in Romania, Spain and Turkey.³ At the shipbuilder, Symantec says a second-stage component dropped webhook.site for a dedicated attacker-operated IP address used for tasking and exfiltration, which The Hacker News gives as 185.82.218[.]119:443.¹² The attackers also deployed a previously undocumented reflective loader, ld.exe, which decrypts an encrypted file in memory using a key supplied only at runtime on the command line; Symantec did not recover the payload, so its function is unknown.¹³ The Hacker News says it is unclear whether any data was stolen.²

Dick O'Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop that hands-on-keyboard activity means a human operator is choosing what to do next, which he described as confirmation that the organisation is a genuine target and that exploitation beyond the initial infection was at least attempted.³ He said the campaign reflected broader intelligence collection aimed at European government and defence targets, that the motive was not certain, and speculated that it could be part of campaigns against nations aiding Ukraine.³ He added that Symantec was surprised the attackers moved their most sensitive follow-up activity onto a dedicated server, when Recorded Future had expected them to keep using free services.³

Why it matters: Symantec says the post-access tradecraft it saw, credential theft by two independent techniques, a persistent network tunnel and a previously undocumented loader, goes beyond what had been publicly reported on this campaign, which gives defence suppliers and police bodies new behaviours and indicators to hunt for.¹²