Russia-linked APT28 breached defense contractors in two NATO countries

Russian state-linked hackers broke into a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two European NATO countries over at least two months this summer, according to research by Symantec reported by The Record on October 20. Symantec attributes the operation to APT28, a group linked to Russia's GRU military intelligence agency, and says the target selection points to a broader intelligence-gathering effort against European government and defense organizations.

What happened

According to The Record, the intrusion at the naval shipbuilder began in July, when an employee opened a malicious Word document received as an email attachment. The first confirmed infection dates to July 24. In the following week, the attackers repeatedly returned to a compromised computer and deployed a tool that had not been documented before. The latest related malicious activity was detected on September 24, although researchers could not confirm that access was continuous throughout the period.

The Record did not name the two countries or the victim organizations, saying only that they are in Europe.

Technical details

The attackers used the Hookedge backdoor to gain access, steal credentials and gather information about the network, The Record reported. Recorded Future's Insikt Group first documented Hookedge in August. Inside the victims' networks, the operators explored internal systems and attempted to steal login credentials. Symantec also found a previously undocumented tool that decrypts and executes malicious code in memory; its ultimate purpose remains unclear.

Researchers could not determine whether sensitive information was stolen. Symantec analyst Dick O'Brien said that in some cases the attackers were on the network for a few weeks and that, given the targets, it is reasonable to assume defense-related information was the objective.

Who is affected

APT28, also tracked as Fancy Bear, BlueDelta and Forest Blizzard, has a long record of targeting governments, militaries and their suppliers. The Record notes that earlier in 2026 researchers linked the group to attacks on maritime, transportation and diplomatic organizations in Poland, Slovenia, Turkey, Greece and the United Arab Emirates, and that British officials warned in April that APT28 had exploited router vulnerabilities to redirect traffic and spy on victims. In 2025, more than 20 Western agencies issued a joint advisory on the group's targeting of logistics and technology firms supporting aid to Ukraine.

What to do

The Record's report does not include specific recommendations. Defense suppliers and public-sector organizations in Europe can reduce exposure by blocking or tightly controlling macros in Office documents received by email, monitoring for unusual credential access and lateral movement, and reviewing published Hookedge indicators against their own telemetry.