APT28 targeted European defense firms in two NATO countries, Symantec says
Original title: Defense contractors in two NATO allies hacked in recent Russia-linked campaign
A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.
Symantec says GRU-linked APT28, also known as Fancy Bear, targeted a naval shipbuilder, a military aircraft engine maker and a law-enforcement agency in two unnamed European NATO countries. In one case an employee opened a malicious Word attachment in July; attackers then explored the network, tried to steal credentials and later ran a previously undocumented in-memory tool. Researchers could not confirm data theft and say activity seen into September suggests the campaign is ongoing.
Unconfirmed: Symantec could not confirm stolen data, uninterrupted access, or the in-memory tool's purpose, and did not name victims or countries.
- Hookedge, first documented in August by Insikt Group, was used for access and credential theft.
- The first confirmed infection was July 24; related activity was seen as late as September 24.
- Symantec did not name the two NATO countries or the victim organizations.
- O'Brien said weeks of access may have allowed data collection, but theft is unconfirmed.
Impact: Network access, credential theft attempts and possible defense data collection
From the original article
2 min read at therecord.mediaThe Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.