Defense contractors in two NATO allies hacked in recent Russia-linked campaign

Russian state-linked hackers targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two NATO countries in a recent espionage campaign, researchers have found.

The attacks were attributed to APT28, a hacking group linked to Russia’s military intelligence agency, the GRU, according to cybersecurity firm Symantec. The researchers did not identify the two NATO countries or the organizations targeted, saying only that the victims were located in Europe.

The hackers used a recently discovered backdoor known as Hookedge to gain access to victims’ systems, steal credentials and gather information about their networks. The malware was first documented in August by Recorded Future’s Insikt Group.

In one attack against a naval shipbuilder, the hackers gained access after an employee opened a malicious Microsoft Word document received as an email attachment in July. The attackers subsequently explored the company’s internal network and attempted to steal login credentials.

Over the following week, the hackers repeatedly returned to a compromised computer and deployed a previously undocumented tool designed to decrypt and execute malicious code directly in the computer’s memory. The tool’s ultimate purpose remains unclear.

The first confirmed infection occurred on July 24, while related malicious activity was detected as late as September 24. The timeline suggests the operation spanned at least two months, although researchers could not establish whether the attackers maintained uninterrupted access throughout that period.

Dick O’Brien, an intelligence analyst at Symantec, told Recorded Future News that researchers could not determine whether the attackers succeeded in stealing sensitive information.

“Given the nature of the targets, it’s reasonable to assume that defense-related information was the objective of the attacks,” O’Brien said. “In some cases, the attackers were on the network for a few weeks, which may have given them opportunities to obtain data.”

According to Symantec, the selection of targets suggests the attacks were part of a broader Russian intelligence-gathering effort focused on European government and defense organizations.

O’Brien said the continued activity observed in September, following Recorded Future’s initial findings in August, suggests the espionage campaign is ongoing.

APT28, also known as Fancy Bear, BlueDelta and Forest Blizzard, has conducted cyber-espionage operations against military, government and defense organizations in Europe and North America for more than a decade. The group gained international attention in 2016 after being linked to the hacking of the Democratic National Committee ahead of the U.S. presidential election.

Western cybersecurity agencies have repeatedly warned about the group’s efforts to compromise organizations involved in defense and military logistics, particularly those supporting Ukraine.

In April, British security officials warned that APT28 had exploited vulnerabilities in internet routers to redirect web traffic and spy on victims. Earlier this year, researchers also identified activity linked to the group targeting maritime, transportation and diplomatic organizations in countries including Poland, Slovenia, Turkey, Greece and the United Arab Emirates.

Last year, more than 20 Western intelligence and cybersecurity agencies issued a joint advisory accusing APT28 of targeting logistics providers and technology companies involved in delivering foreign assistance to Ukraine.