APT28 targeted three national-security organisations in two NATO countries
Symantec linked a Russian GRU-associated group, known as APT28 or Swallowtail, to attacks on a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in two unnamed NATO countries. The campaign ran from at least 24 July to 24 September, but researchers could not confirm whether the attackers stole sensitive data or maintained access throughout.
Bottom line — Symantec saw activity as late as 24 September, but could not establish whether any sensitive information was taken.
Go deeper 6
-
Symantec said a malicious Word attachment opened at the shipbuilder led to the Hookedge backdoor.
-
According to Symantec, Hookedge used an invisible Microsoft Edge window to route commands through the legitimate webhook.site service.
-
Symantec found operators returning to a compromised shipbuilder computer over a week, attempting to steal credentials and opening an SSH tunnel into the internal network.
-
The attackers also deployed an undocumented loader, ld.exe; Symantec could not recover its encrypted payload or determine its purpose.
-
Symantec analyst Dick O’Brien told Recorded Future News that attackers were on some networks for a few weeks, which may have given them opportunities to obtain data.
-
The Record reported that researchers did not identify the countries or organisations targeted.