Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).
The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail , involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that's supplied at runtime.
Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said.
APT28's use of HOOKEDGE was first publicly documented by Recorded Future Insikt Group in late August 2026 in connection with a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.
In the attack aimed at the naval shipbuilder in late July 2026, the threat actors are said to have delivered new variants of HOOKEDGE that abandon the use of webhook[.]site in favor of a dedicated IP address ( ) for both tasking and exfiltration.
The attackers have also been observed dropping a new reflective loader ( ) using a curl command via SSH that's engineered to decode and run a next-stage component.
The backdoor is delivered via macro-enabled Microsoft Word documents and communicates entirely through a webhook[.]site URL, which acts as a channel to stage tasks and to receive execution output.
In a report published late last month, the Computer Emergency Response Team of Ukraine (CERT-UA) revealed that Russian hackers are increasingly targeting the smartphones belonging to Ukrainian military personnel and government officials for espionage and financially motivated attacks.
It's unclear if any data was stolen as a result of these intrusions.
The threats also extend to the Android ecosystem, with threat clusters UAC-0244 and UAC-0263 using decoy apps to deliver two different malware families - CERT-UA also said it observed APT28 exploiting vulnerabilities such as CVE-2026-21509 , a security feature bypass in Microsoft Office, and CVE-2026-8496 , a zero-click vulnerability in the SOGo webmail client, to deliver the COVENANT malware as well as siphon victims' mailbox credentials and data, respectively.
Delivered via spear-phishing lures, HOOKEDGE is a barebones Windows batch script that's capable of accepting attacker-issued commands and sending the results back.
This includes the use of the DarkSword iOS exploit kit, which is distributed via watering-hole attacks through compromised legitimate Ukrainian news outlets and government sites to siphon sensitive data from compromised devices.
"In particular, attacks exploiting XSS vulnerabilities in the Roundcube webmail client were observed.
HOOKEDGE shares significant code and tradecraft overlap with HEADLACE , a modular Windows implant that APT28 has put to use in attacks targeting diplomats since April 2023.
What happened
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).
The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail , involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that's supplied at runtime.
Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said.
What changed
APT28's use of HOOKEDGE was first publicly documented by Recorded Future Insikt Group in late August 2026 in connection with a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.
In the attack aimed at the naval shipbuilder in late July 2026, the threat actors are said to have delivered new variants of HOOKEDGE that abandon the use of webhook[.]site in favor of a dedicated IP address ( ) for both tasking and exfiltration.
The attackers have also been observed dropping a new reflective loader ( ) using a curl command via SSH that's engineered to decode and run a next-stage component.
Who is affected
The backdoor is delivered via macro-enabled Microsoft Word documents and communicates entirely through a webhook[.]site URL, which acts as a channel to stage tasks and to receive execution output.
In a report published late last month, the Computer Emergency Response Team of Ukraine (CERT-UA) revealed that Russian hackers are increasingly targeting the smartphones belonging to Ukrainian military personnel and government officials for espionage and financially motivated attacks.
Why it matters
It's unclear if any data was stolen as a result of these intrusions.
The threats also extend to the Android ecosystem, with threat clusters UAC-0244 and UAC-0263 using decoy apps to deliver two different malware families - CERT-UA also said it observed APT28 exploiting vulnerabilities such as CVE-2026-21509 , a security feature bypass in Microsoft Office, and CVE-2026-8496 , a zero-click vulnerability in the SOGo webmail client, to deliver the COVENANT malware as well as siphon victims' mailbox credentials and data, respectively.
Technical details
Delivered via spear-phishing lures, HOOKEDGE is a barebones Windows batch script that's capable of accepting attacker-issued commands and sending the results back.
This includes the use of the DarkSword iOS exploit kit, which is distributed via watering-hole attacks through compromised legitimate Ukrainian news outlets and government sites to siphon sensitive data from compromised devices.
"In particular, attacks exploiting XSS vulnerabilities in the Roundcube webmail client were observed.
Response
HOOKEDGE shares significant code and tradecraft overlap with HEADLACE , a modular Windows implant that APT28 has put to use in attacks targeting diplomats since April 2023.
Infected machines then fetch these tasks using a hidden, off-screen instance of the Microsoft Edge browser as opposed to relying on a traditional downloader.
What security teams should do
The most recent activity was registered on September 24, 2026, when a Visual Basic Script launcher associated with HOOKEDGE was observed within the shipbuilder's network.
The findings are consistent with a report from Google Threat Intelligence Group (GTIG) in March 2026, which linked the Russian espionage actor UNC6353 to the use of Coruna and DarkSword kits in watering-hole campaigns targeting Ukrainian users since summer 2025.
What remains unknown
The exact nature of the payload remains unknown.
It's unclear if any data was stolen as a result of these intrusions.
Attribution
The Hacker News: The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.