Symantec: Russian APT28 Group Hacked NATO Defense Contractors Using Hookedge Backdoor
Researchers found GRU-linked hackers used a new backdoor to infiltrate European defense firms and a law enforcement agency in a recent espionage campaign.
Key points
- Russian APT28 targeted a naval shipbuilder, aircraft engine maker, and law enforcement agency.
- Attackers used the Hookedge backdoor, first documented in August by Recorded Future.
- Initial infection occurred on July 24, with activity detected through September 24.
Cybersecurity firm Symantec reported that Russian state-linked hackers from group APT28 recently compromised networks belonging to defense contractors and a law enforcement agency in two unnamed NATO countries. The espionage campaign targeted critical infrastructure providers in Europe, specifically a naval shipbuilder and a military aircraft engine manufacturer, alongside a government law enforcement body.
The attackers gained initial access by tricking an employee at the naval shipbuilder into opening a malicious Microsoft Word document attached to an email in July. According to Symantec, the group is linked to Russia's military intelligence agency, the GRU. The researchers did not disclose the specific NATO nations or the names of the targeted organizations, stating only that the victims were located in Europe.
Campaign Tactics and Timeline
The intrusion began with a confirmed infection on July 24, with related malicious activity continuing until at least September 24. This timeline indicates the operation spanned a minimum of two months, although investigators could not confirm if the attackers maintained uninterrupted access throughout that period. The hackers utilized a recently discovered backdoor known as Hookedge to establish their presence within the victims' systems.
Hookedge was first documented in August by Recorded Future's Insikt Group. In the attack against the shipbuilder, the hackers used this backdoor to steal credentials and gather information about the internal network structure. Over the week following the initial breach, the group repeatedly returned to the compromised computer to deploy a previously undocumented tool.
This new tool was designed to decrypt and execute malicious code directly in the computer's memory. The ultimate purpose of this specific capability remains unclear to researchers. Dick O'Brien, an intelligence analyst at Symantec, noted that the continued activity observed in September, after Recorded Future's initial findings in August, suggests the espionage campaign is ongoing.
Target Selection and Objectives
Symantec stated that the selection of targets indicates these attacks are part of a broader Russian intelligence-gathering effort focused on European government and defense organizations. While researchers could not determine if the attackers successfully stole sensitive information, O'Brien said it is reasonable to assume defense-related data was the objective.
The attackers were on the networks for several weeks in some cases, which may have provided opportunities to obtain data. The campaign involved exploring internal networks and attempting to steal login credentials. The combination of targeting both private defense contractors and a public law enforcement agency highlights the group's interest in comprehensive intelligence gathering across the security sector.
What should you do?
Security professionals should monitor for unusual email attachments, particularly Microsoft Word documents, and ensure endpoint detection systems are updated to identify memory-resident malware. Organizations should review access logs for repeated connections from compromised hosts and verify the integrity of credential stores.
What to do and how to stay safe: APT28
- Monitor email gateways for malicious Microsoft Word attachments and block execution from email clients.
- Inspect endpoint memory for undocumented tools that decrypt or execute code without writing to disk.
- Review authentication logs for credential theft attempts and repeated access from single compromised hosts.
- Validate network segmentation to limit lateral movement if a backdoor like Hookedge is detected.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific countries were targeted in this APT28 campaign?
Symantec did not identify the two NATO countries, stating only that the victims were located in Europe.
What malware did the attackers use to gain access?
The hackers used a backdoor known as Hookedge, which was first documented in August by Recorded Future.
Did the attackers successfully steal sensitive data?
Researchers could not determine if the attackers succeeded in stealing sensitive information, though defense data was likely the objective.
