Recent cyber activities attributed to APT28, a notorious Russian state-backed group, have targeted two NATO member states. Known for their sophisticated tactics, APT28, also referred to as BlueDelta and Fancy Bear, has engaged in attacks that include a naval shipbuilder and a manufacturer of military aircraft engines. This information, disclosed by the Symantec Threat Hunter Team, highlights the use of advanced malware tools.
New Cyber Espionage Tools Revealed
Symantec reports that APT28 utilized a backdoor known as HOOKEDGE, alongside an innovative loader developed to decrypt payloads in memory using runtime-supplied cryptographic keys. The naval shipbuilder witnessed attackers repeatedly accessing their systems, employing advanced techniques to steal credentials and establish a persistent SSH tunnel into their network.
This attack signifies a shift from previous methods, with the introduction of a reflective loader that enhances APT28’s cyber arsenal. The loader, identified as ‘ld.exe’, was deployed using SSH commands to execute subsequent attack stages, though the full extent of the payload remains undisclosed.
APT28’s Continued Threat Across Europe
APT28’s activities have extended beyond NATO, with previous campaigns documented by Recorded Future Insikt Group targeting European nations such as Romania, Spain, and Türkiye. These operations, dating from September 2025 to April 2026, showcased HOOKEDGE’s ability to execute commands and communicate via macro-enabled Word documents and webhooks.
Recent modifications to HOOKEDGE have shifted its communication strategy, opting for a direct IP-based approach for task execution and data exfiltration. This evolution in tactics underscores APT28’s adaptability in their persistent cyber endeavors.
Heightened Cyber Threat in Ukraine
In Ukraine, the cyber landscape remains fraught with challenges as CERT-UA highlights an increase in Russian-led attacks. The focus on espionage and financially-motivated incursions on military and government personnel smartphones has intensified. Techniques such as the DarkSword iOS exploit kit and Android-based malware, CAMELSPY and BTMOB RAT, are being deployed to extract sensitive information.
The exploitation of vulnerabilities like CVE-2026-21509 in Microsoft Office and CVE-2026-8496 in SOGo webmail client further illustrates the threat actors’ commitment to compromising Ukrainian systems. These incidents are part of a broader trend, with CERT-UA recording over 3,137 cyber incidents in the first half of 2026 alone.
The discovery of additional LegionRelay command-and-control servers by Team Cymru further confirms the persistent threat landscape. These developments highlight the ongoing cyber conflict in the region and the need for enhanced defensive measures.
As the cyber threat landscape evolves, understanding and mitigating these sophisticated attacks remains crucial for national security and international stability.
