APT28 targets NATO naval and aerospace manufacturers

Symantec researchers have linked intrusions at a European naval shipbuilder and military aircraft engine manufacturer to the Russian cyber espionage group APT28. The campaign also affected a law enforcement organisation, with all three victims located in two unnamed NATO countries. At the shipbuilder, investigators documented the Hookedge backdoor, stolen authentication material, a persistent network tunnel and an additional malware loader whose encrypted payload was not recovered. The findings were published on 20 October following activity observed between July and September.

Symantec’s Threat Hunter Team uses the name Swallowtail for the group also widely known as Fancy Bear and Forest Blizzard. The United States government has attributed APT28 to Russia’s military intelligence service, the GRU. Although the investigation associates the activity with this established group, it does not identify the victim companies, quantify information taken from them or establish disruption to shipbuilding and engine production.

The most detailed record concerns a naval shipbuilder, where the initial infection began on 24 July when a malicious Microsoft Word attachment was opened from an Outlook attachment cache. An embedded macro installed components of Hookedge, a backdoor previously described by Recorded Future researchers in August. The malware used scripts and a concealed Microsoft Edge browser process to fetch commands through the webhook.site service and return the results. This provided a channel for issuing tasks without relying exclusively on a conventional dedicated malware communications process.

Early commands collected information about the compromised computer and the network it could reach, including operating system details, running processes, user information and accessible directories. The attackers subsequently changed to infrastructure under their control and continued issuing commands to the same host. That transition is significant to the sequence of the intrusion: the malicious attachment enabled initial access, but later activity depended on separate command channels and tools installed after the infection.

On 27 July, the operators supplied an SSH private key and used the Windows OpenSSH client to create a persistent connection to their infrastructure. A reverse tunnel through that connection offered a route to services inside the affected organisation from outside its network. Such a connection can let an intruder examine internal resources even when the organisation does not expose those systems directly to the internet. The recorded tunnel demonstrates an effort to extend access, although it does not establish that every internal resource was reached.

The researchers also found a PowerShell technique designed to collect NTLM authentication challenge-response material. By causing the compromised machine to authenticate to a local listener, the attackers could capture authentication data for possible further misuse. The extent of any subsequent successful authentication was not established across the victim network. The documented behaviour nevertheless shows that the intrusion went beyond the installation of Hookedge and included efforts to acquire access material for further activity.

Another tool, named ld.exe, was a previously undocumented reflective loader. It was designed to receive an encrypted file and decryption key as inputs, decrypt its contents in memory and execute the resulting code. Symantec recovered evidence of the file name and key used for one invocation, but not the encrypted payload itself. Consequently, the investigators could not determine the purpose of the additional software. Describing it as a tool for industrial sabotage or a particular type of data theft would exceed the recovered evidence.

Activity at the naval shipbuilder continued beyond the initial burst of commands. Investigators observed related components in late August and a further launcher event on 24 September, the latest activity documented in the published investigation. The evidence does not establish whether that later execution reflected a renewed interactive session or a persistence mechanism running without fresh operator instructions. Nor does the account establish the status of the victim’s remediation at the time of publication.

Naval shipbuilders and military engine manufacturers hold complex records spanning design, component qualification, production changes and supplier relationships. Access to business accounts and internal systems can provide routes to information beyond the first infected workstation, especially where trusted identities are used across several services. Symantec did not identify engineering drawings, production instructions or customer records demonstrably removed in this case. The observed network reconnaissance and credential collection support an espionage assessment without identifying the precise information acquired.

The investigative record also illustrates why finding the initial malware is not equivalent to understanding the complete compromise. A response confined to the original Word document could miss later use of legitimate Windows tools, altered command channels and credentials obtained after initial access. Establishing the extent of an intrusion involves correlating host processes, authentication records and network connections across the period during which access may have persisted.

Symantec has not published evidence that the cyber activity interrupted naval construction, aircraft engine manufacture or deliveries to armed forces. Its confirmed technical findings concern the sequence of intrusion, the access mechanisms employed and an unidentified second-stage payload. The latest publicly described traces date to 24 September, while the identities of the affected organisations and their subsequent operational condition remain undisclosed.