Threats · 5h ago
Symantec attributed a campaign against three European organizations to APT28, with activity detected from July 24 through September 24. The targets were a naval shipbuilder, a military aircraft-engine manufacturer, and a law enforcement agency in two NATO countries.
At the shipbuilder, an employee opened a malicious Word attachment to trigger the initial compromise. APT28 explored the internal network, attempted to steal credentials, and repeatedly returned to a compromised computer over the following week. The attackers also ran malicious code directly in memory using a tool whose purpose remains unclear.
Researchers could not establish whether access was uninterrupted or whether sensitive information was stolen. For defense organizations that exchange sensitive documents by email, the reported activity shows how an initial lure can lead to weeks of possible access; the reporting does not establish how far beyond these three target types the activity reached.
1 source covering this story
The Record from Recorded Future
Defense contractors in two NATO allies hacked in recent Russia-linked campaign
The Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said.
Part of the PlainSec briefing for 2026-10-20