Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

APT28 targeted NATO defense firms and a law-enforcement agency

5 sources · 5 articlesFirst reported Updated ()
What's new

October 21: Reports add the July 24 Word macro, SSH tunnel, NTLM capture and unrecovered ld.exe payload, with Hookedge seen again on September 24.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Symantec says APT28 compromised two NATO defense firms and a police agency; data theft is unconfirmed.

Symantec says GRU-linked APT28, also tracked as Fancy Bear, Forest Blizzard and Swallowtail, compromised a naval shipbuilder, a military aircraft-engine maker and a law-enforcement agency in two unnamed European NATO countries. A malicious Word attachment opened on July 24, 2026 dropped the Hookedge backdoor. Operators later took credential material, opened an SSH tunnel and ran a previously undocumented in-memory loader, ld.exe, whose payload was not recovered. Activity was seen as late as September 24. The Record says data theft is unconfirmed and describes credential theft as attempted; The Hacker News and CyberScoop report that credential material was stolen.

Key facts
  • Victims were unnamed and located in two European NATO countries.
  • Hookedge, first documented in August by Insikt Group, was used for access.
  • ld.exe decrypts its payload in memory; Symantec did not recover it.
  • Operators used an SSH tunnel and a local NTLM capture.
  • Infection began July 24; the Hookedge launcher was seen again September 24.
  • Theft of shipbuilding or other sensitive data remains unconfirmed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 24, 2026Word macro infected a naval shipbuilder with Hookedge · The Record
  2. Jul 31, 2026Operators ran ld.exe against encrypted Events.dat · Cyber Security News
  3. Sep 24, 2026Hookedge launcher was observed again at the shipbuilder · GBHackers

What each outlet adds

beyond the shared facts
  • The RecordNames Insikt Group’s August Hookedge documentation and an unconfirmed-theft caveat.
  • The Hacker NewsGives Hookedge server 185.82.218.119 and earlier Romania, Spain and Türkiye targeting.
  • CyberScoopSays ld.exe needs a runtime key and notes prior Ukraine-support warnings.
  • GBHackersDescribes the Outlook cache, hidden Edge browser and webhook.site tasking.
  • Cyber Security NewsDates the loader to July 31 and describes internal hostname mapping.
Vendors
Microsoft
Products
Microsoft WordMicrosoft EdgeOpenSSH
Threat actors
APT28SwallowtailGREYVIBEUNC6353UAC-0244UAC-0263Fancy BearForest BlizzardBlueDelta
Malware
HOOKEDGEHEADLACELegionRelayDarkSwordCorunaCAMELSPYBTMOB RATHookedgeld.exe
Organizations
SymantecNATOCERT-UATeam CymruGoogle Threat Intelligence GroupRecorded FutureGRU
Countries
RussiaUkraineRomaniaSpainTürkiyeTurkey

Coverage

oldest first · one row per article · UTC
  1. · 5d ago The RecordFirst report

    APT28 targeted European defense firms in two NATO countries, Symantec says

    A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.

  2. · 5d ago The Hacker News

    APT28 breaches NATO naval shipbuilder, deploys reflective loader

    Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.

  3. · 5d ago CyberScoop

    APT28 targeted NATO shipbuilder, engine maker and police agency

    Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.

  4. · 4d ago GBHackers

    APT28 uses Hookedge and an SSH tunnel against NATO defense firms

    A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.

  5. · 4d ago Cyber Security News

    APT28 used Hookedge to tunnel into NATO shipbuilder

    The unnamed intrusion began July 24, 2026, via a Word macro and lasted at least two months.