Researchers at Symantec have attributed a recent espionage campaign to APT28, a hacking group tied to Russia's military intelligence agency, the GRU. The victims include a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency in two NATO countries in Europe. The attackers used a recently discovered backdoor called Hookedge to gain access, steal credentials, and gather information about victims' networks.
In one attack against the naval shipbuilder, an employee opened a malicious Microsoft Word attachment in July, giving the hackers a foothold. Over the following week, they repeatedly returned to the compromised computer and deployed a previously undocumented tool designed to decrypt and execute malicious code directly in memory. The first confirmed infection occurred on July 24, and related activity was detected as late as September 24, suggesting the operation spanned at least two months, though uninterrupted access could not be confirmed.
Symantec could not determine whether the attackers succeeded in stealing sensitive information, but intelligence analyst Dick O'Brien said defense-related information was likely the objective. The continued activity observed in September, after Recorded Future's Insikt Group first documented Hookedge in August, indicates the campaign is ongoing. APT28, also known as Fancy Bear, has a long history of targeting military, government, and defense organizations, including those supporting Ukraine.