Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

Symantec's Threat Hunter Team reports that the Russian state-sponsored group APT28 (also known as BlueDelta, Fancy Bear, Forest Blizzard, and tracked by Symantec as Swallowtail) infiltrated organizations in two NATO member countries, including a naval shipbuilder, a law enforcement agency, and a maker of military aircraft engines. The attackers delivered their HOOKEDGE backdoor through macro-laced Microsoft Word documents and, in the shipbuilder intrusion, spent a week with hands-on-keyboard access, stealing credentials via two separate methods, setting up a persistent SSH tunnel into the internal network, and dropping a previously unknown reflective loader. The HOOKEDGE variant used in this case abandoned its earlier webhook[.]site communication channel for a dedicated IP address to handle tasking and data theft. No exploitation of a specific CVE was tied to this intrusion, and it remains unclear whether data was actually exfiltrated, but the operation highlights APT28's growing tradecraft against NATO-linked industrial and defense targets, following earlier campaigns that also touched products like iOS exploit kits used against Ukrainian officials.