Symantec exposes espionage targeting defence firms in two NATO countries
Symantec disclosed cyberespionage targeting a naval shipbuilder, an aircraft-engine organisation and law enforcement in two NATO countries. Researchers linked the activity to APT28, a group associated with Russian military intelligence. The investigation traces activity from July to September but leaves the countries unnamed and cannot establish whether sensitive information was stolen.
Geopolitics··Evening
Defence suppliers and police are among the targets
Cybersecurity company Symantec disclosed an espionage campaign against organisations in two countries belonging to the North Atlantic Treaty Organization, NATO. Targets included a naval shipbuilder, an organisation working on aircraft engines and a law enforcement body. Researchers attributed the activity to Swallowtail, also known as APT28, a group previously associated by US authorities with Russian military intelligence. They did not name the countries or organisations affected.[1], [2]
A Word document opened the first route in
The first documented intrusion involved a malicious Microsoft Word document. According to the researchers, a macro in the file deployed Hookedge, a backdoor giving attackers remote access. The attackers returned to the target and used additional tools to maintain their foothold. The investigation describes attempts to obtain credentials and communication over encrypted connections, including SSH tunnels. A previously undocumented loader decrypted a component in memory; investigators did not recover all of its functionality.[1]
Sensitive data loss could not be established
Observed traces ran from the final week of July to late September. Publication of the research is the new development. Symantec researcher Dick O’Brien said investigators could not determine whether sensitive information had been exfiltrated. Some components ran in memory and not all delivered payloads were recovered, leaving the extent of access uncertain. The findings concern observed activity at particular organisations, with no confirmed NATO-wide disclosure of lost data.[1]
The first confirmed infection occurred on July 24, with related malicious activity detected as late as September 24. Investigators could not establish whether access remained uninterrupted throughout that period. Recorded Future’s Insikt Group first documented Hookedge in August. APT28 is also tracked as Fancy Bear, BlueDelta and Forest Blizzard. The group attracted international attention over the Democratic National Committee hack in 2016. In April, British security officials warned about its use of compromised internet routers to redirect traffic and spy on victims. Western agencies have also warned about its targeting of organisations supporting Ukraine.[2]
