Cybersecurity
APT28 hits NATO shipbuilder with reflective loader
Symantec said APT28 targeted a NATO naval shipbuilder, law enforcement agency and aircraft engine maker, using HOOKEDGE, credential theft and a newly described loader, while Ukrainian agencies reported related Russian activity.
- Symantec said APT28 targeted two NATO member states and focused on a law enforcement agency, a naval shipbuilder and a military aircraft engine maker.
- During one intrusion at the shipbuilder in late July 2026, the operators returned over about a week, stole credentials, opened a persistent SSH tunnel and used a previously undocumented reflective loader.
- Symantec said the shipbuilder operation used newer HOOKEDGE variants that switched from webhook[.]site to a dedicated IP address for tasking and exfiltration.
- CERT-UA said Russian hackers were targeting Ukrainian smartphones, and it said APT28 also used Office and SOGo flaws, plus Roundcube XSS, to deliver COVENANT.
- Team Cymru said it found five more LegionRelay command-and-control servers and said LegionRelay was a PowerShell RAT attributed to GREYVIBE.
Symantec said APT28 carried out attacks against two NATO member states and that the targets included a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. It said the targets could hold information useful to a foreign intelligence service.
In the shipbuilder case, Symantec said the operators came back to the same host repeatedly over about a week. It said they stole credentials, set up a persistent SSH tunnel into the internal network and used a previously undocumented reflective loader.
Symantec said the operation in late July 2026 used newer HOOKEDGE variants that no longer relied on webhook[.]site and instead used a dedicated IP address for tasking and exfiltration. The report also said Recorded Future Insikt Group had previously publicly documented HOOKEDGE.
CERT-UA said Russian hackers were increasingly targeting Ukrainian smartphones for espionage and financial gain. It said UAC-0244 used decoy apps to distribute CAMELSPY, while UAC-0263 used decoy apps to distribute BTMOB RAT.
CERT-UA also said APT28 used vulnerabilities in Microsoft Office and SOGo, and cross-site scripting in Roundcube, to deliver COVENANT. Team Cymru separately said it had identified five more LegionRelay servers, and that LegionRelay was a PowerShell RAT tied to GREYVIBE.
Named in this story
Companies
- Team Cymru
- The company that identified additional LegionRelay command-and-control servers.
Organisations
- APT28
- The Russia-linked threat actor blamed for the campaigns against NATO members and Ukraine-linked targets.
- NATO
- The alliance whose member states were said to be among the targets.
- Symantec Threat Hunter Team
- The threat-intelligence team that reported the activity and called the cluster Swallowtail.
- Recorded Future Insikt Group
- The team that first publicly documented HOOKEDGE in August 2026.
- UNC6353
- The Russian espionage actor that was linked to the watering-hole campaigns.
- UAC-0244
- The cluster that distributed CAMELSPY through decoy apps.
- UAC-0263
- The cluster that distributed BTMOB RAT through decoy apps.
- GREYVIBE
- The actor assessed to have run the LegionRelay campaigns.
Governments and agencies
- CERT-UA
- The Ukrainian agency that reported the smartphone-targeting activity and related intrusions.
Products and systems
- HOOKEDGE
- The backdoor used in the phishing-based intrusions.
- Microsoft Word
- The document platform used to deliver macro-enabled lures.
- DarkSword
- The iOS exploit kit used in watering-hole attacks.
- CAMELSPY
- The Android malware family used to collect device data.
- BTMOB RAT
- The Android malware family that gave attackers control and exfiltration capability.
- COVENANT
- The malware that CERT-UA said was delivered in some of the attacks.
- LegionRelay
- The PowerShell-based RAT used in attacks on Ukrainian entities.
- SOGo
- The webmail client whose flaw CERT-UA said was abused.
- Roundcube
- The webmail client whose cross-site scripting flaws were reported as exploited.
Places
- Ukraine
- The country whose military personnel, officials and entities were targeted.
How the source tells it
The piece reads like a threat-intelligence roundup, with the strongest colour coming from repeated emphasis on newly seen tooling and on the intelligence value of the targets.
- novelty repeated emphasis on previously undocumented and new tooling
- threat framing the targets were cast as useful to a foreign intelligence service