THE Hacker News reports that the Russia-linked state actor APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard) has been attributed with activity against two NATO member states, including a late July 2026 operation that breached a naval shipbuilder in a NATO country. Symantec Threat Hunter Team, tracking the cluster as Swallowtail, describes the campaign as involving a backdoor called HOOKEDGE and a newly developed loader that decrypts and runs an encrypted payload in memory using a runtime-supplied key.
In the naval shipbuilder intrusion, operators reportedly persisted on the compromised host for about a week, conducted hands-on-keyboard activity, exfiltrated credentials via two methods, opened a persistent SSH tunnel to reach internal networks, and deployed a new reflective loader (ld[.]exe). The attackers used a Windows batch-script-based loader that accepts commands and reports output, with macro-enabled Word documents delivering HOOKEDGE and a webhook-based channel for tasking and results.
The article notes broader context of APT28 activity, including prior HOOKEDGE deployments linked to attacks against government and diplomatic targets in Romania, Spain, and Türkiye, and overlaps with HEADLACE-style tooling used since 2023. It also highlights two credential-theft techniques: pushing an SSH private key to establish a back‑channel and a PowerShell-based NTLM capture tactic.
Evidence cited includes observed infrastructure changes, such as replacing the webhook site with a dedicated IP (185.82.218[.]119:443) for tasking and exfiltration, and references to related campaigns, notably LegionRelay C2 activity reported by Team Cymru. The report also mentions CERT-UA’s 2026 findings, including exploits of CVE-2026-21509 and CVE-2026-8496, and ongoing Ukrainian-targeted operations, underscoring the potential intelligence value of targeted NATO-affiliated entities.