APT28: Hookedge backdoor hits defense firms in two NATO states

APT28, the group linked to Russia’s military intelligence service (GRU), targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two European NATO member states. Symantec’s Threat Hunter Team disclosed the campaign on Tuesday, 20 October, in a report covered by The Record, CyberScoop and The Hacker News. The researchers did not name the countries or the organizations involved.

What happened

According to Symantec, which tracks the group as Swallowtail (also known as Fancy Bear, BlueDelta and Forest Blizzard), the attackers used Hookedge, a backdoor first documented in August by Recorded Future’s Insikt Group. CyberScoop reports that Insikt had already seen the same group using the same backdoor since September 2025 against defense and diplomatic targets in Romania, Spain and Turkey.

The shipbuilder is the case described in the most detail:

• in July an employee opened a malicious Word document received as an email attachment;
• the first confirmed infection dates to 24 July;
• the attackers explored the internal network and tried to steal login credentials;
• over the following week they returned to the same machine several times, with hands-on-keyboard activity, and installed a previously undocumented loader;
• related activity was detected as late as 24 September.

The operation therefore lasted at least two months, although The Record notes that the researchers cannot say whether access was continuous. Symantec could not determine whether any data was stolen. Dick O’Brien, an analyst at Symantec, told The Record that in some cases the attackers stayed on the network for a few weeks and that, given the targets, defense-related information was the likely objective. He told CyberScoop that the manual activity confirms the organization was a deliberate target rather than an accidental infection. In O’Brien’s view, the September activity, after Insikt’s August report, shows that the campaign is still ongoing.

Technical details

• Initial access: email with a malicious Word attachment. The sources do not say which mechanism in the document triggered the infection (macro, vulnerability or something else) and cite no CVEs.
• Hookedge: backdoor used to gain access to systems, steal credentials and gather information about the victims’ networks (The Record).
• New loader, ld.exe: as O’Brien told CyberScoop, it decrypts its payload in memory and needs a key supplied only at runtime on the command line. Without both the encrypted file and the key the payload cannot be recovered: Symantec did not recover it and does not know what it does. The Hacker News describes it, in its headline, as a reflective loader.
• Infrastructure: again according to O’Brien, the attackers moved their most sensitive follow-up activity to a dedicated server, whereas Recorded Future had expected them to keep hopping between free services.
• MITRE ATT&CK (our mapping, based on the activity described): T1566.001 (Spearphishing Attachment), T1204.002 (User Execution: Malicious File), T1018 (Remote System Discovery), credential access (TA0006), T1140 (Deobfuscate/Decode Files or Information) and T1620 (Reflective Code Loading) for the loader.
• Indicators of compromise: the sources publish none apart from the loader’s file name. For hashes and infrastructure, refer to the Symantec report and Insikt Group’s August report.

Background

APT28 has run espionage campaigns against military, government and defense organizations in Europe and North America for more than a decade. The Record recalls that in April British authorities warned about the group exploiting router vulnerabilities to redirect victims’ web traffic, that this year it targeted maritime, transport and diplomatic organizations in Poland, Slovenia, Turkey, Greece and the United Arab Emirates, and that in 2025 more than 20 Western agencies issued a joint advisory on attacks against logistics and technology providers involved in aid to Ukraine. Speaking to CyberScoop, O’Brien suggested a link with the campaigns against countries supporting Ukraine, while stressing that the motive is not certain.

Impact for European and Italian companies

The sources mention no Italian victims, but Romania and Spain are among the countries hit with the same backdoor. The victim profile is clear: shipbuilding, aircraft engines, law enforcement, in other words the defense industry and its supply chain. Building ships and aircraft falls under “manufacture of other transport equipment” in Annex II of NIS2: for many of these companies, and for their suppliers, risk management and incident reporting are obligations, not just good practice. The vector is the most common one there is, a Word attachment: even a small subcontractor can become the way in.

What to do now

1. Tighten the rules on Office attachments: block macros in files that come from the internet, stop Office applications from creating child processes and sandbox attachments from external senders.
2. Search your logs: executions of ld.exe outside developer toolchain folders, especially with long command-line arguments, and processes started by Word or by files just downloaded from email. You need process command-line logging for this.
3. Check credentials: unusual logons, use of privileged accounts from office workstations, attempts to access the memory of authentication processes.
4. Watch outbound traffic: connections to free hosting and file-sharing services and to little-known servers, from machines that should not be using them.
5. Import the indicators from the Symantec and Insikt Group reports into your detection tools and hunt back at least to September 2025.
6. Involve your supply chain: if you work in defense, share the same checks with suppliers that have access to your network or your projects.

How ARXDOME helps

ARX Sentry collects logs and security events from computers, servers and firewalls and brings them into the SOC pages, where unusual processes and logons stand out. ARX Shield integrates the antivirus/EDR console, shows open vulnerabilities and lets you isolate a suspicious machine from the network. With ARX Trace you can run collections and searches across many machines, useful for looking for ld.exe and the published indicators. ARX Horizon enriches every event with threat intelligence sources.

Last updated: 20 October 2026