Russian hacker group APT28 (also known as Fancy Bear, Forest Blizzard, BlueDelta, and Swallowtail), linked to Russia’s GRU military intelligence, carried out a successful cyberattack against a naval shipbuilding enterprise in a NATO country. The attackers gained access to the internal network and maintained a presence for at least two months — from late July to late September 2026.
This was reported on October 20 by Symantec’s Threat Hunter Team (Broadcom). According to the researchers, the campaign affected three organizations in two European NATO countries: a shipbuilding company, a manufacturer of military aircraft engines, and a law enforcement agency. All of the targets are related to defense and national security and were likely of interest to a foreign intelligence service.
The first confirmed incident at the shipyard was recorded on July 24, 2026. An employee opened a malicious Microsoft Word document received by email (the file was opened from the Outlook attachment cache). An embedded macro launched the infection chain with the Hookedge backdoor.
After the initial compromise, the operators returned to the compromised computer and conducted active “hands-on-keyboard” activity for approximately one week. They:
- stole credentials using two methods (including placing an SSH key and capturing an NTLM handshake);
- established a persistent SSH tunnel from their server into the company’s internal network;
- deployed a previously undocumented reflective loader (ld.exe) that decrypts and runs a payload in memory (the payload itself was not recovered by researchers).
The last related activity was observed on September 24, 2026. Researchers were unable to confirm whether access remained continuous throughout the period or whether the attackers succeeded in exfiltrating sensitive data. However, the choice of targets indicates an intelligence-gathering purpose.
APT28 has long specialized in espionage against military, government, and defense organizations in Europe and North America. The group gained widespread notoriety after the 2016 attack on the U.S. Democratic National Committee and is linked by U.S. authorities to a GRU unit (Unit 26165). Earlier in 2026, its activity was observed against maritime, transportation, and diplomatic targets in several countries, including Poland, Slovenia, Turkey, and Greece.
Symantec and other researchers note that such operations fit into a broader Russian campaign to collect intelligence on European defense and government structures, including those involved in supporting Ukraine. The names of the company and the specific NATO countries were not disclosed in the report.
