APT28 hacked defense contractors in two NATO countries

Symantec attributed a recent espionage campaign against a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in two NATO countries to APT28, a group tied to Russia's GRU. The hackers used the Hookedge backdoor and a previously undocumented in-memory execution tool, with activity observed from July 24 to September 24.

• Victims included a naval shipbuilder, an aircraft engine maker and a law enforcement agency
• Initial access came via a malicious Word document emailed in July 2026
• Attackers used the Hookedge backdoor first documented in August
• Activity was observed from July 24 through September 24