The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).

The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that's supplied at runtime.

Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said.

"During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity," Symantec said in a report shared with The Hacker News. "They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network and deployed a previously undocumented reflective loader."

APT28's use of HOOKEDGE was first publicly documented by Recorded Future Insikt Group in late August 2026 in connection with a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.

HOOKEDGE shares significant code and tradecraft overlap with HEADLACE , a modular Windows implant that APT28 has put to use in attacks targeting diplomats since April 2023.

Source link