Dive Brief:
A Russia-linked hacker group broke into the network of a shipbuilder in a NATO member state during a two-month campaign that also targeted government agencies and other critical manufacturers, Symantec researchers said on Tuesday.
The operation, conducted by operatives from APT28, also known as Fancy Bear, involved both familiar malware and a mysterious new piece of code.
Symantec said the hacking campaign had a clear espionage goal and warned potentially vulnerable businesses to protect themselves.
Dive Insight:
The newly disclosed Russia-linked campaign is the latest example of Moscow using cyberspace to seek every possible advantage in its war against Ukraine and its geopolitical conflict with NATO.
In addition to the shipbuilder, where the intrusion attempt was successful, APT28 hackers also targeted a law-enforcement agency and a company that makes aerospace engines. “The common thread across these targets is their relevance to national security and defense policy,” Symantec researchers wrote, adding that the campaign’s breadth “is consistent with a collection effort tasked broadly against European government and defense targets rather than a single focused operation.”
Symantec assembled a picture of the campaign using forensic data about the hackers’ Hookedge malware, which the group delivered through infected Microsoft Word documents. In the attack on the shipbuilder, an employee opened the document on July 24, 2026, triggering the embedded malware, which spawned several files that established a communications link between the attackers and the victim machine. The hackers then collected information about the machine and its files and began mapping the shipbuilder’s network.
While security experts have observed APT28 using Hookedge in the past, the latest campaign against NATO targets is notable because the hackers also used a new loader tool to trigger activity based on a decrypted file. Symantec said it could not determine the loader’s purpose because it was unable to recover the file in question.
After the initial burst of activity in late July, the hackers’ malware remained on the shipbuilder’s network through late September. Symantec last saw activity from the loader on Sept. 24, although researchers said it was unclear whether that activity represented new engagement from the hackers or the continued presence of a scheduled task that the hackers had set up.
Symantec provided indicators of compromise for the malware and the hackers’ infrastructure so that companies could monitor for signs of intrusions.
Click Here For The Original Source.
——————————————————–
