Russian military intelligence-linked hackers compromised a naval shipbuilder, a military aircraft-engine manufacturer and a law enforcement agency in two NATO member states, Symantec’s Threat Hunter Team reported Tuesday. The campaign, tracked by Symantec as Swallowtail, involved the group commonly known as APT28, Fancy Bear and Forest Blizzard, which MITRE ATT&CK identifies as a Russian GRU-linked threat group.
The victims were not publicly named, and Symantec did not disclose evidence that the attackers successfully removed sensitive data. Their selection nevertheless points to an intelligence-collection operation focused on defense production, naval capabilities and law-enforcement information. The activity was observed in recent months and affected organizations in two European NATO countries, according to Symantec’s reporting.
At the shipbuilder, operators repeatedly returned to a compromised host over roughly a week, demonstrating what researchers call hands-on-keyboard activity. That behavior indicates a human operator was directing the intrusion rather than relying solely on an automated malware routine. The attackers attempted to obtain credential material, established a persistent SSH tunnel into the internal network and used PowerShell-based techniques to support credential theft.
The intrusion also involved HOOKEDGE, a backdoor that Recorded Future’s Insikt Group disclosed in August after identifying related activity against government and diplomatic organizations in Romania, Spain and Türkiye between September 2025 and April 2026. The malware used webhook.site, a legitimate developer service, for command-and-control traffic, a tactic that can make network detection more difficult. Recorded Future described the activity as linked with moderate confidence to APT28.
Symantec additionally identified a previously undocumented reflective loader named ld.exe. The tool was delivered through an SSH session using curl and was designed to decrypt and execute a subsequent payload in memory. Its decryption key was supplied at runtime on the command line; because researchers recovered neither the encrypted payload nor the key, they could not determine what the final component did.
There is no reported CVE, software patch or public proof of concept associated with the intrusion tools described in the research. Defenders at defense contractors and government agencies should instead investigate anomalous SSH sessions, unexpected use of webhook services, newly created SSH keys, PowerShell credential-access activity and execution of unrecognized loaders. Organizations should also review endpoint and proxy telemetry for activity associated with HOOKEDGE and ld.exe, while treating the campaign as a targeted espionage threat rather than a conventional mass exploitation event.
