Threats · 4h ago
Symantec says APT28 targeted organizations in two NATO states, including a naval shipbuilder where operators returned to a compromised host repeatedly over one week, stole credentials using two methods, and opened a persistent Secure Shell (SSH) tunnel. The other targets were a law-enforcement agency and a military aircraft-engine manufacturer.
At the shipbuilder, APT28 also deployed a previously undocumented loader that decrypts an encrypted payload in memory using a key supplied while it runs, rather than leaving the decrypted program as a normal file on disk. The group delivered its HOOKEDGE backdoor through macro-enabled Microsoft Word documents, keeping Word lures in its spear-phishing toolkit.
For defense and manufacturing networks, the lasting exposure is the credentials and internal route, not only the loader: if credentials were reused or the tunnel reached sensitive systems, removing malware from the initial host would not settle the scope. Symantec’s account does not establish how far the operators moved inside the network.
1 source covering this story
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
APT28 targeted two NATO states with HOOKEDGE and a new reflective loader, stealing credentials and establishing an SSH tunnel at a naval shipbuilder.
Part of the PlainSec briefing for 2026-10-20