The Russia-linked state-sponsored hacking group APT28 has been linked to cyberattacks against organisations in two NATO member states, including a naval shipbuilder, a law enforcement agency and a manufacturer of military aircraft engines.
The activity was tracked by Symantec’s Threat Hunter Team under the name Swallowtail. Researchers said the campaign involved use of the HOOKEDGE backdoor as well as a previously undocumented reflective loader designed to decrypt and execute an encrypted payload directly in memory using a cryptographic key supplied at runtime.
The targets were organisations holding information that could be valuable to a foreign intelligence service, according to Symantec.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Naval Shipbuilder Faced Repeated Intrusions
In one attack against a naval shipbuilder, the operators repeatedly returned to a compromised host over the course of about a week in what researchers described as hands-on-keyboard activity.
Symantec said the attackers used two separate techniques to steal credential material, created a persistent SSH tunnel into the organisation’s internal network and deployed a previously undocumented reflective loader.
APT28, also known as BlueDelta, Fancy Bear and Forest Blizzard, had previously been linked to use of the HOOKEDGE backdoor in cyberespionage operations targeting government and diplomatic organisations in Romania, Spain and Türkiye.
HOOKEDGE shares similarities with HEADLACE, a modular Windows implant previously associated with APT28. The backdoor has been delivered through macro-enabled Microsoft Word documents and can receive commands and return execution results.
Earlier versions communicated through webhook.site URLs. In the attack against the naval shipbuilder in late July 2026, the attackers used newer variants that communicated with a dedicated IP address for both tasking and data exfiltration.
Attackers Used Two Credential-Theft Methods
Symantec said the operators used two distinct techniques to obtain credentials from the compromised environment.
In one method, the attackers placed an SSH private key on the system and immediately used it to establish a persistent background tunnel back to infrastructure under their control.
In the second method, they executed a short PowerShell script that created a listener on the machine’s loopback address and forced the system to authenticate to it. This allowed the attackers to capture the resulting NTLM handshake.
The attackers also downloaded a new reflective loader named “ld.exe” through a curl command executed over SSH.
The loader was designed to decode and run a next-stage component in memory. Researchers said the exact nature of that subsequent payload remained unknown.
Symantec said the combination of credential theft, persistent tunnelling and the newly identified loader showed post-compromise activity extending beyond the delivery methods previously associated with the campaign.
Russian Cyber Activity Continues Against Ukraine
Separate research has also identified additional command-and-control infrastructure linked to attacks against Ukrainian organisations.
Team Cymru said it found five more servers associated with LegionRelay, a PowerShell-based remote access trojan attributed to the threat actor GREYVIBE.
LegionRelay can enumerate and steal files, capture screenshots, extract browser information, access Telegram and WhatsApp data and configure remote desktop access.
GREYVIBE has been linked to persistent attacks against Ukraine and Ukraine-related entities since at least August 2025.
The Computer Emergency Response Team of Ukraine has separately reported that Russian hackers are increasingly targeting smartphones used by Ukrainian military personnel and government officials.
The activity has included use of the DarkSword iOS exploit kit through compromised Ukrainian news and government websites, as well as Android malware families CAMELSPY and BTMOB RAT.
CERT-UA also said APT28 continued to exploit Microsoft Office and webmail vulnerabilities to deliver malware and steal mailbox credentials.
Ukraine recorded 3,137 cyber incidents in the first half of 2026, which CERT-UA estimated was 8% higher than the total recorded during the second half of 2025.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
