Russia-Linked APT28 Targets European Defense Contractors in Espionage Campaign
APT28, also known as Fancy Bear, has been linked to a recent espionage campaign targeting defense contractors and a law enforcement agency in two unnamed NATO countries.
Russian state-sponsored hackers, identified as APT28 (also known as Fancy Bear), have recently targeted critical defense contractors and a law enforcement agency across two NATO member states in Europe. The sophisticated espionage campaign, detailed by cybersecurity firm Symantec, aimed to gather intelligence on entities involved in national security and defense.
The attackers leveraged a recently documented backdoor malware named Hookedge to infiltrate the victims' networks. This malware is designed to gain initial access, steal credentials, and facilitate further reconnaissance within the compromised systems. Researchers noted that in one instance, a naval shipbuilder was compromised after an employee opened a malicious Microsoft Word document delivered via email in July.
Following the initial intrusion, the threat actors actively explored the internal network of the targeted shipbuilder, attempting to exfiltrate sensitive login credentials. During their presence on the network, which in some cases lasted for several weeks, the attackers deployed a tool capable of decrypting and executing malicious code directly in the computer's memory, though its precise function remains under investigation.
The confirmed malicious activity spanned from late July to late September, indicating an operation that lasted at least two months. While Symantec could not definitively confirm the success of data exfiltration, the nature of the targets—a naval shipbuilder and a military aircraft engine manufacturer—strongly suggests that defense-related information was the primary objective.
APT28 is a well-established hacking group with known ties to Russia's military intelligence agency, the GRU. The group has a long history of conducting cyber-espionage operations against government, military, and defense organizations in Europe and North America. It gained significant notoriety in 2016 for its alleged involvement in hacking the Democratic National Committee.
Western cybersecurity agencies have consistently warned about APT28's persistent efforts to compromise organizations involved in defense and military logistics, particularly those supporting Ukraine. Previous campaigns have included exploiting internet router vulnerabilities and targeting maritime, transportation, and diplomatic entities.
The continued activity observed in September, even after initial findings were reported in August, suggests that this particular espionage campaign is ongoing and remains a significant threat. The selection of targets aligns with broader Russian intelligence-gathering objectives focused on European defense capabilities and allied military operations.
This campaign underscores the persistent threat posed by state-sponsored cyberespionage groups targeting critical infrastructure and defense sectors within NATO countries. The use of advanced malware like Hookedge and the sustained operational tempo highlight the evolving tactics and enduring motivations of actors like APT28.