APT28 targeted NATO shipbuilder, engine maker and police agency
Original title: Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
Symantec said GRU-linked hackers compromised a naval shipbuilder, a military aircraft-engine maker and a law enforcement agency in NATO countries. The group, also known as APT28, Fancy Bear, Forest Blizzard and Swallowtail, returned to a shipbuilder host over a week and stole credentialed material. They used the Hookedge backdoor and a previously undocumented loader. Recorded Future had earlier tied the same backdoor to defense and diplomatic targets in Romania, Spain and Turkey.
Unconfirmed: The campaign motive is unconfirmed; an analyst only speculated it related to support for Ukraine.
- Hands-on-keyboard activity lasted about a week at the shipbuilder.
- ld.exe decrypts its payload in memory and needs a runtime command-line key.
- Symantec did not recover the payload and does not know its function.
- Western governments previously warned the group targeted firms supporting Ukraine.
Impact: Espionage access and stolen credential material at defense targets
- Threat actors
- APT28SwallowtailFancy BearForest Blizzard
- Organizations
- SymantecRecorded FutureGRU
From the original article
3 min read at cyberscoop.com
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said. The post Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign appeared first on CyberScoop.
By Tim Starks · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.