The APT28 NATO campaign has compromised three organisations in two unnamed European NATO member states. The confirmed victims include a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency.
Disclosed on 20 October 2026, the espionage activity involved the Hookedge backdoor, credential theft, covert network access and a previously undocumented reflective loader. The campaign was active from at least 24 July to 24 September 2026.
APT28 NATO campaign targeted three organisations
Symantec’s Threat Hunter Team attributed the intrusions to APT28, a Russia-linked group associated with Russia’s GRU military intelligence service. Symantec tracks this activity cluster as Swallowtail, while other security researchers have used names including Fancy Bear, BlueDelta and Forest Blizzard.
The victims were organisations likely to hold sensitive information about military capabilities, defence production and law enforcement activity. However, neither the organisations nor the two affected countries have been publicly named. Reports connecting these October disclosures to Romania, Spain or Turkiye are not confirmed, as those countries were associated with earlier Hookedge research rather than these newly disclosed compromises.
The earliest confirmed infection occurred at the naval shipbuilder on 24 July 2026. Attackers then returned repeatedly to a compromised computer over roughly a week, showing that this was not a single automated malware infection. It involved active operator engagement inside the victim’s environment.
The latest malicious activity connected to the disclosed cluster was detected on 24 September 2026. Symantec published its findings on 20 October 2026, when reporting also confirmed that all three organisations had been compromised rather than merely targeted.
Key events in the disclosed timeline
- 24 July 2026: The first confirmed infection was identified at the naval shipbuilder.
- Late July 2026: Operators repeatedly accessed the compromised host, stole credentials, established an SSH tunnel and deployed additional tooling.
- 27 August 2026: Earlier research publicly documented Hookedge in a separate campaign against European government and diplomatic targets.
- 24 September 2026: The latest related malicious activity in the newly disclosed cluster was detected.
- 20 October 2026: Details of the three compromises were made public.
How Hookedge supported the APT28 NATO campaign
Hookedge is a batch-script backdoor associated with previous BlueDelta operations. Researchers assess that it shares code and operational similarities with HEADLACE, another tool used in earlier APT28 activity.
Earlier Hookedge campaigns used macro-enabled Microsoft Word documents for delivery. Some lures impersonated Spanish government material, while later examples used more generic prompts designed to persuade recipients to enable macros. The available reporting does not identify a software vulnerability or confirm the precise initial lure used against every October victim.
This distinction matters because the APT28 NATO campaign was not based on the exploitation of a newly disclosed product flaw. No affected product versions, security patch or public proof-of-concept exploit apply. The relevant environment is a Windows enterprise network where a user may run macros in an internet-originated Word document and where Microsoft Edge is available.
Traffic hidden through legitimate services
Hookedge has used webhook.site, a legitimate service designed to receive and inspect web requests, for command tasking and the transfer of stolen output. The malware can retrieve tasks through a hidden Microsoft Edge browser instance, helping its traffic resemble ordinary browser activity.
The use of a legitimate service complicates detection because webhook.site also has benign uses. A connection to it is not proof of compromise by itself. Defenders need to consider the initiating process, endpoint behaviour, user activity and surrounding network events.
Research into a July 2026 intrusion also found a newer Hookedge stage using dedicated infrastructure instead of webhook.site. During the naval shipbuilder compromise, the address 185.82.218.119 on port 443 was identified as command-and-control infrastructure. The attackers used encrypted TLS communications for tasking and exfiltration.
What happened inside the naval shipbuilder
The naval shipbuilder intrusion provides the clearest picture of the operators’ methods. After gaining access, they returned to the same compromised host multiple times over approximately one week and used two techniques to obtain credential material.
Stolen credentials can allow an intruder to move beyond the initially infected computer, access internal services or impersonate legitimate users. In this case, the operators also created a persistent SSH tunnel from attacker-controlled infrastructure into the internal network.
An SSH tunnel can provide an encrypted route into a network and carry traffic that may be difficult to inspect. SSH is widely used for legitimate administration, so defenders must distinguish authorised connections from unexpected tunnels originating on employee workstations or other systems that do not normally require them.
The attackers additionally deployed a previously undocumented reflective loader named ld.exe. A reflective loader places code directly into memory rather than relying on a conventional installed executable, which can reduce artefacts left on disk.
The observed loader required a runtime key before it could decrypt and execute its encrypted payload in memory. This design can obstruct automated analysis because the file cannot reveal its full purpose without the correct key and execution conditions.
Together, Hookedge, credential theft, the SSH tunnel and ld.exe indicate a layered intrusion. The operators established remote control, sought reusable access and introduced tooling intended to make payload execution less visible.
Current exploitation status and affected environments
The APT28 NATO campaign represents confirmed in-the-wild exploitation, not a theoretical threat. Three organisations were compromised, and the shipbuilder case included hands-on-keyboard activity and repeat access. The available reporting also indicates a presence lasting weeks in parts of the wider cluster.
No public exploit code is involved because this is an active espionage operation using phishing, bespoke malware and post-compromise techniques. No specific Microsoft Word or Edge version has been identified as vulnerable. Updating those products remains important, but patching alone does not address this campaign’s documented methods.
Only a limited set of public indicators is available. These include the dedicated command-and-control address, the ld.exe filename and relevant use of webhook.site. Filenames can be changed, while shared web services can create false positives, so behavioural evidence is more useful than relying on any single indicator.
Why the campaign matters to UK defence suppliers
Although the disclosed victims are in unnamed European countries, the targeting has direct relevance to the UK defence supply chain. Smaller contractors and subcontractors may hold engineering data, programme information, credentials or trusted access that could support wider intelligence collection.
The APT28 NATO campaign also demonstrates how attackers can blend malicious activity with familiar tools. Word documents, Microsoft Edge, SSH and web services are common in business environments, making unusual combinations of otherwise legitimate activity especially important to investigate.
Actions tied to the Hookedge intrusion methods
Organisations supporting defence or public safety programmes should prioritise controls that address the behaviours observed in these incidents:
- Block or tightly restrict macros in documents originating from the internet.
- Hunt for hidden or headless Microsoft Edge execution, particularly when launched by scripts or unusual parent processes.
- Review outbound access to webhook services and validate whether it has an approved business purpose.
- Alert on unexpected SSH processes, persistent tunnels and outbound SSH activity from ordinary workstations.
- Search for ld.exe, while recognising that filename matching alone is insufficient.
- Check historical network records for connections to 185.82.218.119 on port 443 and investigate associated endpoints.
- Monitor for scheduled task abuse, credential access and in-memory payload execution around suspicious Word or browser activity.
These measures align directly with the techniques documented in the compromises. Because the countries and victim names remain undisclosed, organisations should avoid assumptions about geographic limits and instead assess whether similar behaviour is present in their own environments.
Originally reported by The Record from Recorded Future News.
