Russian APT28 Breaches NATO Naval Shipbuilder and Deploys Previously Undocumented Reflective Loader

Russia-linked hacking group APT28 has breached a NATO-member naval shipbuilder and other defense-sector targets using a new reflective loader and updated variants of the HOOKEDGE backdoor tool, according to Symantec's Threat Hunter Team.

The Broadcom-owned threat intelligence unit published findings revealing a sophisticated cyber espionage campaign that extended across multiple NATO nations. The intrusions targeted entities holding information of direct strategic value to a foreign intelligence agency — making this operation one of the more alarming state-sponsored attacks disclosed in recent months. Understanding the mechanics and attribution of campaigns like this requires robust cyber threat intelligence practices and risk management frameworks that security teams can act on in real time.

Inside the Naval Shipbuilder Breach

Symantec is tracking the APT28 activity cluster under the moniker Swallowtail. The group — also known as BlueDelta, Fancy Bear, and Forest Blizzard — targeted a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines across two NATO member states. APT28 is among the most capable and persistent advanced persistent threat actors currently operating against Western infrastructure, with a track record spanning more than a decade of high-value intrusions.

The most technically detailed intrusion occurred against the naval shipbuilder in late July 2026. Operators returned to a compromised host repeatedly over the course of a week in what Symantec described as "hands-on-keyboard activity" — indicating direct human interaction rather than automated exploitation. This level of deliberate, sustained access suggests the operators were searching for specific data rather than conducting opportunistic reconnaissance.

"During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity," Symantec said in a report shared with The Hacker News. "They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network and deployed a previously undocumented reflective loader."

Two Distinct Credential-Theft Techniques

The two credential-theft techniques deployed were notably distinct, and their combined use indicates a deliberate redundancy strategy — ensuring access even if one method is detected and blocked.

In the first, attackers pushed an SSH private key onto the compromised host and immediately used it to open a persistent SSH connection back to their own server. In the second, they ran a self-contained PowerShell script that stood up a listener on the host's loopback address and forced the machine to authenticate to it — capturing the resulting NTLM handshake.

The Undocumented Reflective Loader

Attackers also dropped a new reflective loader file named ld.exe via a curl command through SSH. The loader is engineered to decode and execute a next-stage payload in memory using a cryptographic key supplied at runtime — a technique that leaves minimal forensic trace on disk and substantially complicates post-incident analysis. The exact nature of the final payload remains unknown.

The most recent confirmed activity within the shipbuilder's network was recorded on September 24, 2026, when a Visual Basic Script launcher associated with HOOKEDGE was observed. It is not yet confirmed whether data was successfully exfiltrated.

How HOOKEDGE Evolved to Evade Detection

The HOOKEDGE backdoor sits at the center of this campaign. First publicly documented by Recorded Future's Insikt Group in late August 2026, HOOKEDGE was linked to earlier espionage operations targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.

The tool shares significant code overlap with HEADLACE — a modular Windows implant that APT28 has deployed against diplomatic targets since April 2023. HOOKEDGE itself is a barebones Windows batch script capable of receiving attacker commands and returning execution output. Its apparent simplicity is, in part, a feature: lightweight tooling is harder to fingerprint with conventional endpoint detection rules.

From Webhook Delivery to Dedicated Infrastructure

In earlier versions, the backdoor was delivered through macro-enabled Microsoft Word documents and communicated through webhook[.]site URLs. A hidden, off-screen instance of the Microsoft Edge browser was used to fetch attacker-issued tasks — a technique designed to blend malicious traffic into normal browser activity and bypass network-level monitoring that whitelists known browser processes.

By the time of the late July 2026 naval shipbuilder attack, APT28 had updated HOOKEDGE variants to abandon webhook[.]site entirely in favor of a dedicated IP address — 185.82.218[.]119:443 — for both tasking and data exfiltration. This infrastructure shift signals operational maturity: moving away from shared, easily-flagged third-party services toward controlled, purpose-built command-and-control endpoints that are harder to take down through platform abuse reporting alone.

"The tradecraft observed after initial access — credential theft through two independent techniques, a persistent network tunnel, and a previously undocumented loader — goes beyond the delivery mechanism that has so far been publicly reported on this campaign," Symantec noted.

Russian Cyber Operations Broaden Across Ukraine and NATO Targets

The Swallowtail campaign does not exist in isolation. Ukraine's Computer Emergency Response Team (CERT-UA) reported that Russian hackers are increasingly targeting the smartphones of Ukrainian military personnel and government officials for espionage and financially motivated attacks.

Threat clusters UAC-0244 and UAC-0263 are distributing decoy mobile applications to deliver two distinct malware families. UAC-0244 deploys CAMELSPY — which harvests device system information, geolocation, SIM card details, contacts, call logs, and gallery images. UAC-0263 deploys BTMOB RAT — which grants full remote control of infected Android devices alongside data exfiltration capabilities. Recognizing the behavioral patterns and delivery methods behind these tools is essential; a broader understanding of the different types of malware and how they operate helps security teams build more effective detection strategies across both desktop and mobile environments.

iOS Targeting and Watering-Hole Campaigns

On the iOS side, the DarkSword exploit kit has been distributed through compromised legitimate Ukrainian news outlets and government websites. Google's Threat Intelligence Group linked the Russian espionage actor UNC6353 to DarkSword and related kits in a March 2026 report, noting their use in watering-hole campaigns targeting Ukrainian users since summer 2025.

Webmail Exploitation and Zero-Click Vulnerabilities

CERT-UA also flagged APT28's exploitation of two vulnerabilities: CVE-2026-21509, a security feature bypass in Microsoft Office, and CVE-2026-8496, a zero-click vulnerability in the SOGo webmail client. Both were used to deliver the COVENANT malware and siphon mailbox credentials. Attacks exploiting XSS vulnerabilities in the Roundcube webmail client were also observed alongside macro-enabled Excel documents.

Zero-click vulnerabilities are particularly concerning in enterprise environments because they require no user interaction to trigger — meaning conventional security awareness training offers no meaningful protection against them. Patching cadence and network segmentation become the primary defensive levers.

Scale of Russian Cyber Activity in 2026

These incidents are part of the 3,137 cyber incidents recorded by CERT-UA in the first half of 2026 — approximately 8% more than in the second half of 2025. Separately, Team Cymru identified five additional LegionRelay command-and-control servers used against Ukrainian entities. LegionRelay is a PowerShell-based remote access trojan attributed to threat actor GREYVIBE and supports file exfiltration, screenshot capture, browser data theft, and RDP access setup.

What This Means for NATO Defense Organizations

The scale and technical sophistication of APT28's operations signal an escalating threat to NATO defense infrastructure and Ukrainian government networks heading into late 2026. For a current overview of how nation-state actors like APT28 are classified and tracked globally, the MITRE ATT&CK Framework remains the most comprehensive public reference available to security practitioners.

Defense contractors and government agencies operating in NATO countries should treat this campaign as a direct warning. Concretely, that means:

• Auditing SSH access controls and monitoring for unauthorized key additions to authorized_hosts files
• Monitoring for NTLM relay activity, particularly against loopback addresses and internal authentication services
• Restricting macro-enabled document execution across enterprise environments through Group Policy and application control policies
• Prioritizing patching against known XSS and zero-click vulnerabilities in webmail clients such as Roundcube and SOGo, given their active exploitation in this campaign

Security teams can reference Symantec's published indicators of compromise — including the identified loader filename ld.exe and the command-and-control IP address 185.82.218[.]119 — to proactively hunt for signs of Swallowtail intrusions within their own networks. Given the deliberate, human-directed nature of the access observed inside the naval shipbuilder's environment, organizations should also review their endpoint detection rules for hands-on-keyboard behaviors that automated exploit chains would not typically produce.