Symantec: GRU hackers hit NATO shipbuilder, engine maker and law enforcement

Symantec attributed an espionage campaign against two defense firms and a law enforcement agency in NATO countries to Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, a group linked to Russia's GRU. Targets included a naval shipbuilder, a military aircraft engine maker and a police agency; the hackers used the Hookedge backdoor and an undocumented loader, ld.exe.

• Swallowtail is tied to the GRU and the 2016 DNC hack
• On the shipbuilder, hackers spent a week doing hands-on-keyboard activity on a compromised host
• The Hookedge backdoor was previously seen against targets in Romania, Spain and Turkey
• The ld.exe loader decrypts its payload in memory using a runtime command-line key