Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
Summary: Symantec's Threat Hunter Team attributed attacks on two NATO member states to the Russia-linked APT28, hitting a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer with a backdoor called HOOKEDGE and a previously undocumented reflective loader. In the late July 2026 shipbuilder intrusion, operators returned to a compromised host over a week, stole credentials via two separate techniques, opened a persistent SSH tunnel into the internal network, and dropped a loader (ld.exe) fetched by curl over SSH, with a HOOKEDGE-associated VBS launcher seen in the network as recently as September 24, 2026.
Why it matters: A nation-state actor held hands-on-keyboard access inside a naval shipbuilder for a week and built a persistent tunnel into its internal network, and Symantec says it is unclear whether any data was stolen.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026