// AI threat desk · 21 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumAPT28CVSS not assigned

APT28 targeted European military and law enforcement organizations

The victims were in Europe, but Symantec did not identify the countries or organizations.

· 2 min read
AI-generated image of security analysts reviewing blurred cyber incident dashboards in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Symantec said researchers could not establish whether the attackers maintained uninterrupted access throughout the operation.
  • Symantec said the targeted organizations were located in Europe, but researchers did not identify the two NATO countries or the organizations.
  • Symantec said the hackers used the HOOKEDGE backdoor to access systems, steal credentials and gather information about victims’ networks.

The attackers used the HOOKEDGE backdoor to access systems and gather information about victims’ networks. Symantec said the first confirmed infection occurred on July 24, with related malicious activity detected as late as September 24.

Symantec linked the activity to APT28, which it described as a group linked to Russia’s military intelligence agency, the GRU. The targeted organizations were in Europe, but researchers did not identify the two NATO countries or the victims.

On this page

HOOKEDGE entered a network through a malicious Word attachment

Symantec said an employee opened a malicious Microsoft Word document received as an email attachment in July. The attackers then explored the company’s internal network and attempted to obtain login credentials.

The previously undocumented loader was designed to decrypt and run an encrypted payload in memory using a cryptographic key supplied at runtime.

HOOKEDGE variants used a dedicated IP address for tasking

Symantec said HOOKEDGE variants used in the naval shipbuilder attack in late July 2026 abandoned webhook.site in favor of a dedicated IP address for tasking and exfiltration.

Symantec said the operation spanned at least two months, but researchers could not establish whether the attackers maintained uninterrupted access throughout that period.

The Hacker News said the most recent activity was recorded on September 24, when a Visual Basic Script launcher associated with HOOKEDGE was observed inside the shipbuilder’s network. It remains unclear whether any data was taken during the intrusions.

FAQ

Who was behind the attacks?

Symantec attributed the attacks to APT28, a group linked to Russia’s military intelligence agency, the GRU.

How did the attackers enter the network?

Symantec said an employee opened a malicious Microsoft Word document received as an email attachment in July. The attackers then explored the internal network and attempted to obtain login credentials.

Was data taken in the APT28 campaign?

The Hacker News said it remains unclear whether any data was taken during the intrusions. Symantec also said researchers could not establish whether the attackers maintained uninterrupted access throughout the operation.

Sources

  1. BlueDelta Targets Defense and Diplomacy with HOOKEDGE, Recorded FuturePrimary
  2. Defense contractors in two NATO allies hacked in recent Russia-linked campaign, The Record
  3. Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader, The Hacker News
  4. NATO, Wikipedia
How we checked this story
ClaimSourceStatus
Symantec said russian state-linked hackers targeted a naval shipbuilder, military aircraft engine manufacturer and law enforcement agency in two NATO countries.Symantec, via The RecordAttributed
Symantec said the targeted organizations were located in Europe, but researchers did not identify the two NATO countries or the organizations.Symantec, via The RecordAttributed
Symantec said the hackers used the HOOKEDGE backdoor to access systems, steal credentials and gather information about victims’ networks.Symantec, via The RecordAttributed
Symantec said the first confirmed infection occurred on July 24, and related malicious activity was detected as late as September 24.Symantec, via The RecordAttributed
Symantec said the operation spanned at least two months, although researchers could not establish whether attackers maintained uninterrupted access.Symantec, via The RecordAttributed
Symantec said an employee opened a malicious Microsoft Word attachment in July, after which attackers explored the network and attempted to steal login credentials.Symantec, via The RecordAttributed
Symantec said the loader decrypts and runs an encrypted payload in memory using a cryptographic key supplied at runtime.Symantec, via The Hacker NewsAttributed
Symantec said in late July 2026, HOOKEDGE variants used a dedicated IP address instead of webhook.site for tasking and exfiltration.Symantec, via The Hacker NewsAttributed
The Hacker News said the most recent activity was recorded on September 24, 2026, and it remains unclear whether any data was stolen.The Hacker NewsAttributed
NATO is an intergovernmental military alliance comprising 32 member states.WikipediaConfirmed

Could not verify

  • Whether the attackers successfully stole sensitive information is not established
  • Whether the attackers maintained uninterrupted access throughout the campaign is not established
  • Whether the two NATO countries and targeted organizations can be identified is not established
apt
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok