APT28 Targets NATO Defense Organizations With HOOKEDGE Backdoor and New Reflective Loader

October 20, 2026 – The Russia-linked cyber-espionage group APT28 has been linked to attacks against organizations in two NATO member states, including a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency. Researchers say the campaign involved credential theft, persistent network access and a previously undocumented reflective loader designed to execute encrypted payloads in memory.

According to the Symantec Threat Hunter Team, which tracks this activity under the name Swallowtail, the attacks demonstrate how an intrusion can progress beyond initial access into deeper network access and potential intelligence collection. The affected organizations and NATO countries have not been publicly identified.

APT28 Campaign Targets Defense and Law Enforcement

APT28 is also known as Fancy Bear, BlueDelta and Forest Blizzard. Security researchers associate the group with cyber-espionage operations targeting government, diplomatic and defense-related organizations.

In the latest reported campaign, the attackers used a backdoor known as HOOKEDGE to establish communication with compromised systems. During an intrusion involving a naval shipbuilder, operators reportedly returned to a compromised host repeatedly over approximately a week, suggesting interactive activity rather than a single automated attack.

Researchers described several post-compromise actions, including credential theft, the establishment of a persistent SSH tunnel into the organization’s internal network and the deployment of a previously undocumented loader. These actions can allow an intruder to maintain access and move toward additional systems, depending on the permissions and network controls in place.

HOOKEDGE Backdoor Uses Microsoft Word Documents

HOOKEDGE was publicly documented by Recorded Future’s Insikt Group in August 2026. Earlier reporting connected it to espionage activity targeting government and diplomatic organizations in Romania, Spain and Türkiye.

The backdoor has been described as a Windows batch-script-based tool capable of receiving commands and returning their output. In the previously reported delivery chain, attackers used macro-enabled Microsoft Word documents and a web-based service to relay tasks and results. A hidden Microsoft Edge browser instance was reportedly used to retrieve those tasks.

In the later naval shipbuilder incident, researchers observed variants that switched away from the previously documented web service to a dedicated IP address for command-and-control communications. This change illustrates why defenders should avoid relying on a single network indicator to identify an intrusion.

Two Credential-Theft Techniques Observed

Symantec reported two distinct techniques used to obtain credential material during the naval shipbuilder intrusion.

First, the attackers introduced an SSH private key to a compromised host and used it to establish a persistent, backgrounded tunnel. Such a tunnel can provide a route from attacker-controlled infrastructure into an organization’s internal network.

Second, they used a PowerShell script to trigger an authentication attempt against a listener on the compromised machine itself, capturing an NTLM authentication handshake. Depending on the circumstances, captured authentication material may support further credential attacks or unauthorized access.

The combination is significant because credentials and persistent network pathways can extend the impact of an initial compromise. Even when the original malware is detected, unauthorized keys, stolen credentials and remote access mechanisms may remain security concerns.

New Reflective Loader: What Researchers Know

The campaign also involved a previously undocumented executable identified as ld.exe. Researchers described it as a reflective loader designed to decrypt an encrypted payload and execute it in memory, using a cryptographic key supplied at runtime.

Memory-based execution can make some forms of malicious activity harder to identify through conventional file-scanning methods. However, it does not make an attack invisible: endpoint telemetry, process behavior, authentication logs and network activity can still provide useful detection opportunities.

Importantly, the exact nature and purpose of the next-stage payload remain unknown because researchers did not recover it. It would therefore be premature to attribute specific capabilities to that component beyond the behavior documented in the report.

Broader Cyber Threats Affecting Ukraine

The reporting also highlights other cyber operations targeting Ukrainian organizations. Team Cymru identified additional command-and-control servers associated with activity involving LegionRelay, a PowerShell-based remote-access tool attributed in the supplied reporting to a threat actor tracked as GREYVIBE.

Separately, Ukraine’s national incident response team, CERT-UA, reported 3,137 cyber incidents during the first half of 2026, an increase of approximately 8% compared with the second half of 2025. The incidents included activity involving malicious documents, webmail vulnerabilities and mobile malware.

Researchers have also warned of campaigns targeting smartphones used by Ukrainian military personnel and government officials. Reported techniques include deceptive applications and watering-hole attacks designed to compromise devices and collect sensitive information.

These operations involve different threat clusters and tools. Their appearance in the same reporting does not establish that all the campaigns were conducted by the same operators or formed part of a single coordinated operation.

How Organizations Can Defend Against These Attacks

Organizations in defense, aerospace, law enforcement and government should review controls that address both initial access and post-compromise activity.

Recommended measures include:

• Strengthen email security: Restrict risky Office macro behavior, inspect suspicious attachments and train employees to report unexpected documents.
• Monitor authentication activity: Investigate unusual NTLM authentication events, repeated failed logins, unexpected credential use and abnormal access to internal systems.
• Audit SSH access: Review authorized keys, unexpected SSH connections and persistent tunnels that are not associated with approved administrative activity.
• Improve endpoint detection: Monitor suspicious script execution, unusual browser processes, unexpected executables and activity that may indicate in-memory payload execution.
• Segment critical networks: Restrict communication between ordinary workstations and sensitive engineering, defense or operational systems.
• Investigate suspected compromises: Preserve logs and forensic evidence, contain affected systems, revoke exposed credentials and keys, and check for additional persistence before returning systems to service.

Defenders should use the latest technical advisories from trusted security vendors and national incident response teams to guide threat hunting. Indicators of compromise should be assessed in context rather than treated as definitive proof of attribution on their own.

Conclusion

The APT28-linked activity reported by Symantec illustrates the risks posed by cyber-espionage campaigns against organizations connected to national security. The reported use of HOOKEDGE, credential-theft techniques, persistent SSH tunneling and a new reflective loader shows how attackers can attempt to maintain access and extend their reach after an initial compromise.

For NATO-related suppliers and other sensitive organizations, the priority is to strengthen email defenses, monitor credentials and remote access, and investigate suspicious endpoint behavior. Because the final payload remains unidentified, defenders should focus on the observed behaviors and verified indicators rather than assuming capabilities that researchers have not confirmed.

Sources: The Hacker News  – APT28 targets a NATO naval shipbuilder | Symantec Threat Hunter Team – Swallowtail campaign analysis | The Record – Defense contractors targeted in two NATO countries