APT28 Hacked Defence and Police Targets in Two NATO Countries, Symantec Says

Russian state-backed hackers broke into a naval shipbuilder, a maker of military aircraft engines and a law enforcement agency in two NATO countries, according to research from Symantec’s Threat Hunter Team published on 20 October 2026. Symantec tracks the group as Swallowtail, better known as APT28 or Fancy Bear. For defence suppliers and police IT teams in Europe, the warning is that the campaign may not be over.

Neither the countries nor the organisations have been named. The Record reported that Symantec would say only that the victims were in Europe. What the research does show, in unusual detail, is how the attackers moved once a single email attachment had been opened.

One Word document, two months of access

The shipbuilder intrusion began on the afternoon of 24 July 2026, when a malicious Word document was opened straight from Outlook’s attachment cache, Symantec says. Its macro dropped the Hookedge backdoor, which takes instructions through webhook.site, a public web service, and fetches them using a hidden, off-screen Microsoft Edge window “rather than a conventional downloader”.

That design let the attackers blend into ordinary web traffic. Three days later a more capable second stage switched to a dedicated server run by the attackers. Seven tasks then arrived within about 30 seconds, a pace the researchers say is consistent with an operator working interactively rather than an automated timer.

The attackers then went after credentials in two ways. They pushed an SSH private key onto the machine and used it to open what Symantec calls “a persistent, backgrounded tunnel” from their server into the shipbuilder’s network. Separately, a short PowerShell script tricked the computer into authenticating to itself, capturing a login handshake that could be cracked offline or reused against other machines.

A new tool with an unknown purpose

On 31 July the attackers ran a “previously undocumented” loader, ld.exe, which decrypts a file and runs it in memory using a key supplied at runtime. Symantec recovered the key and the file name but not the encrypted payload itself, “so its ultimate function is unknown”.

The infection did not simply stop. The same launcher and loader were still on the machine in late August, and the launcher was seen again on 24 September. Symantec says it cannot tell whether that reflects a scheduled task still running or renewed interest from the operators.

Hookedge was first documented by Recorded Future’s Insikt Group in August. Symantec says the post-intrusion activity it found “goes beyond the delivery mechanism that has so far been publicly reported on this campaign”.

What the attackers were after

Symantec cannot say whether anything was stolen. “Given the nature of the targets, it’s reasonable to assume that defense-related information was the objective of the attacks,” Dick O’Brien, an intelligence analyst at Symantec, told The Record. “In some cases, the attackers were on the network for a few weeks, which may have given them opportunities to obtain data.”

O’Brien said the activity seen in September, after Recorded Future’s August report, suggests the campaign is ongoing. Symantec describes the targeting as consistent with “a collection effort tasked broadly against European government and defense targets rather than a single focused operation”.

The group’s record supports that reading. The US government has identified it as a unit of Russia’s GRU military intelligence agency, and it was linked to the 2016 hack of the Democratic National Committee. The Record notes that British officials warned in April that APT28 had exploited internet routers to spy on victims.

Our read

This is a textbook espionage chain: a booby-trapped document, quiet use of a legitimate web service, then credential theft and a tunnel for deeper access. For security and compliance teams in the defence supply chain, the practical lesson is Symantec’s own advice that finding Hookedge means assuming the intrusion may be ongoing, and hunting for the tunnelling and credential theft rather than just removing the backdoor. Outbound SSH from office machines and hidden browser windows are worth alerting on.

The open questions are who the victims are and what, if anything, left their networks. Symantec has published indicators of compromise, and any national cyber agency statement naming affected sectors or countries would be the next real development.

Sources

1. Symantec Threat Hunter Team, security.com: “Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries” (20 October 2026)
2. The Record: “Defense contractors in two NATO allies hacked in recent Russia-linked campaign” (Daryna Antoniuk, 20 October 2026)
3. Recorded Future Insikt Group: “BlueDelta Targets Defense and Diplomacy with HOOKEDGE” (August 2026)
4. CISA: “Russian GRU Targeting Western Logistics Entities and Technology Companies”

Related stories

• FirstVDS Says Hackers Used a VMmanager Flaw to Copy Customer Data
• Cyber Breaches: SoftBank Cloud Ransomware, Qilin’s 53 Japanese Victims, Asos’s Bigger Leak and Denmark’s Register