Symantec Attributes Breaches at NATO Naval Shipbuilder and Aircraft Engine Maker to Russia's APT28

Russian state-linked hackers broke into a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two European NATO countries this summer, according to research Symantec's Threat Hunter Team disclosed today, Oct. 20.

Symantec attributes the operation to APT28, also tracked as Fancy Bear, BlueDelta and Forest Blizzard, a group tied to Russia's military intelligence agency, the GRU. Symantec tracks this activity cluster under the name Swallowtail.

Symantec has not named the two countries or the organizations. It says only that the victims are in Europe.

A timeline of at least two months

The first confirmed infection hit the naval shipbuilder on July 24. An employee opened a malicious Microsoft Word document that arrived as an email attachment.

The latest related malicious activity was detected September 24. Symantec says it cannot establish whether the attackers held uninterrupted access across that span.

In the shipbuilder attack, the operators returned to a compromised host repeatedly over about a week. Symantec describes that as hands-on-keyboard activity, meaning a human at the controls rather than an automated infection.

What the attackers used

The entry point was HOOKEDGE, a barebones Windows batch-script backdoor. Recorded Future's Insikt Group first documented it in late August 2026, in a campaign against government and diplomatic targets in Romania, Spain and Türkiye between September 2025 and early April 2026. That research does not tie those three countries to the newly disclosed victims.

HOOKEDGE shares code and tradecraft with HEADLACE, a modular Windows implant APT28 has used against diplomats since April 2023. It arrives through macro-enabled Word documents and takes commands through a hidden, off-screen instance of Microsoft Edge.

Earlier versions ran their command traffic through the legitimate service webhook.site. The variants used against the shipbuilder in late July dropped that service for a dedicated IP address, 185.82.218.119 on port 443, for both tasking and exfiltration.

Symantec documented two separate ways the attackers stole credentials:

• They pushed an SSH private key onto the compromised host and used it to open a persistent, backgrounded tunnel from their own server into the victim's internal network.
• They ran a short PowerShell script that set up a listener on the machine's loopback address and forced the system to authenticate to it, capturing the resulting NTLM handshake.

They also pulled down a previously undocumented reflective loader, named "ld.exe," using a curl command over SSH. The loader decrypts and runs an encrypted payload directly in memory, using a key supplied at runtime. What that next-stage payload does is still unknown.

What Symantec cannot say

Symantec could not determine whether sensitive information was actually taken. Dick O'Brien, an intelligence analyst at Symantec, told Recorded Future News that the target list makes the goal fairly plain.

"Given the nature of the targets, it's reasonable to assume that defense-related information was the objective of the attacks," O'Brien said. "In some cases, the attackers were on the network for a few weeks, which may have given them opportunities to obtain data."

That is an assessment, not a confirmed loss. Symantec says the pattern points to a broader Russian intelligence-gathering effort aimed at European government and defense organizations.

O'Brien said activity continuing in September, after Recorded Future's August findings, suggests the espionage campaign is ongoing.

Not new, and not exotic

The method is old-school. Nothing in the disclosed intrusions turns on a freshly discovered software flaw. The chain starts with a user enabling macros in an emailed Word file, then moves through stolen credentials and a tunnel.

APT28 has run espionage against military, government and defense organizations in Europe and North America for more than a decade. It drew international attention in 2016 when it was linked to the hack of the Democratic National Committee. Western cybersecurity agencies have repeatedly warned about its efforts to compromise defense and military logistics organizations.

The targets here are the kind that matter in a shooting war: a builder of warships, a maker of military aircraft engines, and a police agency. Those organizations hold production data, capability details and investigative files that a foreign intelligence service would value, according to Symantec.

The open questions are specific. Symantec has not said which countries were hit, whether any data left the networks, or what the ld.exe loader was meant to deliver. With the activity still observed as late as September 24, the victims themselves are the ones who will have to answer the first of those.

Symantec's report went to The Hacker News and The Record ahead of today's disclosure.