A Russia-linked cyber-espionage campaign targeted a naval shipbuilder, a military aircraft engine manufacturer and a law-enforcement agency across two unnamed NATO countries, according to Symantec findings reported by The Record.
Symantec attributed the activity to APT28, also known as Fancy Bear, BlueDelta and Forest Blizzard. The group has been linked to Russia’s military intelligence agency, the GRU, although the attribution in this case remains Symantec’s assessment.
The operation lasted at least two months, beginning with a first confirmed infection on July 24. Related malicious activity was still being detected on September 24. Symantec analyst Dick O’Brien said the September activity, which followed separate research published in August, indicated that the campaign was continuing.
That campaign-wide timeframe does not mean the attackers maintained uninterrupted access to every victim. Researchers could not establish continuous access across the entire period, while O’Brien said the intruders remained inside some networks for a few weeks.
A Word attachment opened the route into a shipbuilder
In the naval shipbuilder case, an employee opened a malicious Microsoft Word document delivered as an email attachment in July. After obtaining access, the attackers surveyed the organization’s internal network and tried to collect login credentials.
The initial tooling included Hookedge, a backdoor capable of establishing access, gathering information about a network and stealing credentials. Recorded Future’s Insikt Group first documented Hookedge in August, according to the report.
During the week after the document was opened, the attackers repeatedly returned to a compromised computer. They also installed a previously undocumented tool that decrypts malicious code and executes it directly in memory. Researchers had not determined the tool’s final purpose.
The use of an in-memory component complicates detection because relevant evidence may not be limited to conventional files stored on disk. Email, endpoint, authentication and network telemetry can therefore be important when reconstructing activity after a suspicious document was opened.
Sensitive data theft remains unconfirmed
Researchers could not determine whether the attackers successfully removed sensitive information from the affected environments.
O’Brien assessed that defense-related intelligence was a likely objective because of the organizations selected. He also said that access lasting several weeks could have created opportunities to obtain data. Neither point confirms that information was actually exfiltrated.
The identities of the organizations and the two NATO countries were not disclosed. Symantec interpreted the combination of defense-industry and government targets as part of a wider Russian intelligence-collection effort directed at European institutions.
Defensive priorities for potentially exposed organizations
The activity was not presented as exploitation of a named software vulnerability, so the immediate response is not centered on a specific patch. Organizations in European defense, aerospace and law enforcement should instead examine whether employees received or opened unexpected Word attachments and correlate those events with subsequent credential access, network discovery and repeated activity on the recipient’s computer.
Systems showing signs consistent with compromise should be isolated while investigators establish the scope of access. Credentials accessible from those systems should be treated as potentially exposed and rotated through the organization’s established incident-response process. Defenders should also review memory, endpoint and network evidence rather than relying solely on scans for files left on disk.
The latest reported campaign activity was detected on September 24, making retrospective checks especially relevant for organizations that may have encountered suspicious document-based email during the period beginning in July.
