Following insights from The Record, Russian state-linked hackers have launched a targeted espionage campaign against critical defense and law enforcement entities across two NATO countries in Europe.
The attacks are attributed to the hacking group APT28, which is associated with the Main Intelligence Directorate of the Russian General Staff, known as the GRU. Cybersecurity firm Symantec identified that the group targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency. The hackers utilized a backdoor called Hookedge to infiltrate systems, steal credentials and map internal networks. In one instance, an employee opened a malicious Microsoft Word document in July, allowing attackers to deploy tools that execute code directly in memory. The campaign, which spanned from July 24 to Sept. 24, suggests a persistent effort to gather intelligence on European defense capabilities. While the total volume of stolen data remains unconfirmed, analysts believe the objective was to acquire sensitive defense information. APT28, also known as Fancy Bear, has operated for over 10 years, frequently targeting government and military logistics. Western intelligence agencies continue to monitor the group, noting its ongoing efforts to compromise organizations supporting Ukraine and other regional interests. The campaign highlights the persistent threat posed by state-sponsored actors to critical infrastructure.
Source: The Record
