Russia-linked APT28 hacked European defense contractors and a law enforcement agency using Hookedge malware

Updated: 2026.10.20 15H ago 2 sources

Malware Social Engineering & Phishing Threat Actors & APTs

Russian state-linked hackers targeted a European naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency in two NATO countries. Symantec attributed the campaign to APT28, also known as Fancy Bear, and said the attackers used malicious Microsoft Word email attachments and the Hookedge backdoor to steal credentials and map victim networks. In one case, activity ran from July 24 to September 24 and included a memory-only payload decryption and execution tool.

Why it matters: Defense, aerospace, and government organizations in Europe should treat this as an ongoing espionage campaign and review phishing defenses, endpoint detections, and credential exposure tied to Hookedge and APT28 activity. Staff should be especially cautious with Word attachments delivered by email, and defenders should hunt for follow-on access persisting over weeks.

Sources

Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

info@thehackernews.com (The Hacker News) 2026.10.20 93% relevant

This appears to be a direct update on the same intrusion cluster: APT28 targeting European defense organizations in NATO countries. The new article adds victim detail (a NATO naval shipbuilder) and malware/technique detail about a new reflective loader used in the operation.

Defense contractors in two NATO allies hacked in recent Russia-linked campaign

2026.10.20 100% relevant

This article establishes a distinct APT28 espionage campaign against unnamed European defense contractors and a law enforcement target, centered on Hookedge malware and July-September 2026 intrusions.