Cybersecurity researchers have uncovered an espionage operation targeting defense-related organizations in Europe, including a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency. The campaign has been attributed to APT28, a hacking group associated with Russia’s military intelligence agency, the GRU. According to cybersecurity firm Symantec, the affected organizations were located in two NATO member countries, although their identities and locations have not been disclosed.
The operation relied on a backdoor called Hookedge, which enables attackers to access compromised systems, collect login credentials and investigate internal networks. The malware was documented by Recorded Future’s Insikt Group in August, adding to concerns about the group’s continued efforts to obtain information from strategically important organizations.
One documented intrusion began in July after an employee at a naval shipbuilding company opened a malicious Microsoft Word document delivered through an email attachment. Following the initial compromise, the attackers began examining the organization’s internal network and attempting to obtain credentials that could help them access additional resources.
The activity continued over the following weeks. Investigators found that the hackers repeatedly revisited an infected computer and introduced a previously undocumented tool capable of decrypting and executing malicious code directly in system memory. Researchers have not yet determined the tool’s ultimate purpose, leaving questions about the full scope of the operation unanswered.
The first confirmed infection was recorded on July 24, while associated malicious activity continued to appear as late as September 24. This indicates that the campaign extended across at least two months. However, researchers could not confirm whether the attackers maintained continuous access to the compromised environment throughout that period.
Symantec intelligence analyst Dick O’Brien told Recorded Future News that investigators were unable to establish whether sensitive information had been successfully exfiltrated. Nevertheless, the nature of the affected organizations suggests that defense-related intelligence may have been a primary objective. O’Brien noted that prolonged access could have provided attackers with opportunities to collect valuable information.
The selection of targets also points toward a wider intelligence-gathering effort involving European government and defense interests. The continued activity observed in September, after the campaign was documented in August, suggests that the operation may still be underway.
APT28, also known as Fancy Bear, BlueDelta and Forest Blizzard, has conducted cyber-espionage operations against military, government and defense organizations across Europe and North America for more than a decade. The group attracted international attention in 2016 following its association with the hacking of the Democratic National Committee ahead of the U.S. presidential election.
Western cybersecurity agencies have repeatedly linked the group to operations involving defense infrastructure, military logistics and organizations supporting Ukraine.
In April, British security officials warned that APT28 had exploited internet router vulnerabilities to redirect web traffic and conduct surveillance. Other reported campaigns have targeted maritime, transportation and diplomatic organizations in Poland, Slovenia, Turkey, Greece and the United Arab Emirates.
Last year, more than 20 Western intelligence and cybersecurity agencies jointly warned that the group had targeted logistics providers and technology companies involved in delivering foreign assistance to Ukraine. The latest findings add to continuing concerns about cyber-espionage against organizations connected to European defense and security.
Read the original article:
Russia-Linked Hackers Target NATO Defense Contractors in European Espionage Campaign