Targets included a naval shipbuilder, military aircraft engine manufacturer and law enforcement agency; researchers could not confirm data theft

According to a group of cybersecurity researchers, Russian military intelligence–linked hackers have infiltrated organisations in two NATO member states, including a naval shipbuilder, a manufacturer of military aircraft engines, and a law enforcement agency.

The advanced persistent threat group Swallowtail, also tracked as APT28, Fancy Bear, and Forest Blizzard, has been linked to the campaign. The targets were likely chosen because they hold information of direct intelligence value.

The two NATO countries were not revealed, but the affected organisations are within Europe. The attackers had used Hookedge, a backdoor that Recorded Future’s Insikt Group first documented in August. Other details:

  • In the shipbuilder intrusion, an employee had opened a macro-enabled Microsoft Word document on 24 July, 2026. Because the file was found in the Outlook attachment cache, researchers concluded it had arrived by email.
  • Hookedge receives commands through the legitimate webhook.site service and conceals its activity in a Microsoft Edge browser window that is only one pixel in size and positioned off-screen.
  • For roughly a week afterward, operators repeatedly returned to the compromised machine in activity consistent with hands-on-keyboard intrusions.
  • The hackers had obtained credentials through two methods:
    • They placed an SSH private key on the system and created a persistent tunnel from their own server into the shipbuilder’s internal network. They also used a PowerShell script to capture NTLM authentication handshakes.
    • In addition, they deployed ld.exe, a previously unknown reflective loader that decrypts its payload in memory and executes it only when supplied with a runtime key. The payload could not be recovered, leaving its purpose undetermined.
    • The first confirmed infection had occurred on 24 July 2026, and related activity continued through at least 24 September 2026.
    • It could not be established whether the attackers had maintained uninterrupted access during that period.

Researchers said they could not determine whether sensitive information was actually stolen. According to Symantec analyst Dick O’Brien, one of the researchers, given the nature of the targets, defense-related information was a reasonable objective, and that the attackers’ weeks-long presence may have created opportunities to acquire data. He also said the September activity indicates the campaign may still be underway.

The US government identifies Swallowtail as part of Russia’s GRU. The group had gained wide attention in 2016 after being linked to the hack of the Democratic National Committee. British authorities warned in April 2026 that APT28 had exploited router vulnerabilities for espionage, and more than 20 Western governments had accused the group last year of targeting organizations involved in delivering aid to Ukraine.