APT28 Targets NATO Defense Contractors in Recent Cyber Espionage Campaign

Russian state-linked hackers have targeted a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency in two NATO countries as part of a recent espionage campaign, according to researchers.

The attacks were attributed to APT28, a hacking group associated with Russia’s military intelligence agency, the GRU, as reported by cybersecurity firm Symantec. The specific NATO countries and organizations involved were not disclosed, with researchers only stating that the victims are located in Europe.

The hackers utilized a newly discovered backdoor known as Hookedge to infiltrate the victims’ systems, steal credentials, and gather information about their networks. This malware was first documented in August by Recorded Future’s Insikt Group.

In one incident involving a naval shipbuilder, the hackers gained access after an employee opened a malicious Microsoft Word document sent as an email attachment in July. Following this, the attackers explored the company’s internal network and attempted to steal login credentials.

Over the next week, the hackers returned to the compromised computer multiple times, deploying a previously undocumented tool designed to decrypt and execute malicious code directly in the computer’s memory. The ultimate purpose of this tool remains unclear.

The first confirmed infection occurred on July 24, with related malicious activity detected as late as September 24. This timeline indicates that the operation lasted at least two months, although researchers could not confirm whether the attackers maintained continuous access during that time.

Dick O’Brien, an intelligence analyst at Symantec, noted that researchers could not determine if the attackers successfully stole sensitive information. “Given the nature of the targets, it’s reasonable to assume that defense-related information was the objective of the attacks,” O’Brien said. He added that the attackers were on the network for several weeks, potentially giving them opportunities to obtain data.

Symantec’s analysis of the targeted organizations suggests that these attacks are part of a broader Russian intelligence-gathering effort focused on European government and defense entities.

O’Brien indicated that the ongoing activity observed in September, following Recorded Future’s initial findings in August, suggests that the espionage campaign is still active.

APT28, also known as Fancy Bear, BlueDelta, and Forest Blizzard, has been conducting cyber-espionage operations against military, government, and defense organizations in Europe and North America for over a decade. The group gained notoriety in 2016 after being linked to the hacking of the Democratic National Committee during the U.S. presidential election.

Western cybersecurity agencies have repeatedly warned about APT28’s attempts to compromise organizations involved in defense and military logistics, particularly those supporting Ukraine.

In April, British security officials warned that APT28 had exploited vulnerabilities in internet routers to redirect web traffic and spy on victims. Earlier this year, researchers also identified activities linked to the group targeting maritime, transportation, and diplomatic organizations in countries including Poland, Slovenia, Turkey, Greece, and the United Arab Emirates.

Last year, over 20 Western intelligence and cybersecurity agencies issued a joint advisory accusing APT28 of targeting logistics providers and technology companies involved in delivering foreign assistance to Ukraine.

Source: The Record