APT28 Targets NATO Entities With New Reflective Loader and Credential-Theft Techniques
Summary
Symantec attributed attacks on NATO-country entities to APT28, including credential theft and a persistent tunnel at a naval shipbuilder. A new loader’s payload is unknown, and it is unclear whether data was stolen.
Key points
- Symantec attributed activity targeting a law enforcement agency, naval shipbuilder, and military aircraft-engine manufacturer in two NATO member states to APT28.
- At the shipbuilder, attackers reportedly returned to a compromised host over a week, stole credentials using two techniques, and opened a persistent SSH tunnel into the internal network.
- New HOOKEDGE variants reportedly used a dedicated IP address instead of webhook[.]site for tasking and exfiltration.
- Attackers deployed an undocumented reflective loader, ld.exe, designed to decode and run a next-stage component; the payload is unknown.
- Symantec reported that the latest observed HOOKEDGE-associated activity in the shipbuilder’s network was on September 24, 2026; whether data was stolen is unclear.
- CERT-UA reported Russian-linked threats against Ukrainian devices and APT28 exploitation of vulnerabilities in Microsoft Office and SOGo to deliver malware or obtain mailbox credentials and data.
- Team Cymru identified five additional LegionRelay command-and-control servers used in attacks targeting Ukrainian entities.
Article Details
- Event Type
- Cyber espionage and intrusion activity attributed to APT28, including credential theft, persistent network access, and deployment of a previously undocumented loader.
- Impact
- Targets included a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer in two NATO member states. Attackers reportedly stole credential material, established a persistent SSH tunnel, and used infrastructure for tasking and exfiltration. Whether data was stolen is unclear, and the loader's payload is unknown.
MITRE ATT&CK
T1059.001 · PowerShellAttackers ran a PowerShell script to capture an NTLM handshake.T1105 · Ingress Tool TransferA curl command over SSH was used to deliver the reflective loader.T1187 · Forced AuthenticationAttackers forced a compromised machine to authenticate to a listener on its loopback address and captured the resulting NTLM handshake.T1552.004 · Private KeysAttackers placed an SSH private key on a compromised host and used it to open a connection to their server.
CVE
CVE-2026-21509CERT-UA also said it observed APT28 exploiting vulnerabilities such as CVE-2026-21509, a security feature bypass in Microsoft Office, and CVE-2026-8496, a zero-click vulnerability in the SOGo webmail client, to deliverCVE-2026-8496exploiting vulnerabilities such as CVE-2026-21509, a security feature bypass in Microsoft Office, and CVE-2026-8496, a zero-click vulnerability in the SOGo webmail client, to deliver the COVENANT malware as well as
Threat Actors
APT28Russia-linked state-sponsored threat actor attributed with the reported intrusions. The source identifies BlueDelta, Fancy Bear, and Forest Blizzard as aliases.BlueDeltaNamed in the source as an alias of APT28, which it attributes with the reported intrusions.Fancy BearNamed in the source as an alias of APT28, which it attributes with the reported intrusions.GREYVIBEThreat actor to which LegionRelay is attributed; assessed to have persistently targeted Ukraine and Ukraine-related entities since at least August 2025.UAC-0244Threat cluster reported by CERT-UA as using decoy apps to deliver malware to Android users.UAC-0263Threat cluster reported by CERT-UA as using decoy apps to deliver malware to Android users.UNC6353Russian espionage actor that Google Threat Intelligence Group linked to Coruna and DarkSword watering-hole campaigns targeting Ukrainian users.
Malware
CorunaIntelligence Group (GTIG) in March 2026, which linked the Russian espionage actor UNC6353 to the use of Coruna and DarkSword kits in watering-hole campaigns targeting Ukrainian users since summer 2025.CovenantOffice, and CVE-2026-8496, a zero-click vulnerability in the SOGo webmail client, to deliver the COVENANT malware as well as siphon victims' mailbox credentials and data, respectively.HEADLACEHOOKEDGE shares significant code and tradecraft overlap with HEADLACE, a modular Windows implant that APT28 has put to use in attacks targeting diplomats since April 2023. Delivered via spear-phishing lures, HOOKEDGE isHOOKEDGEis tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memoryLegionRelayThe development comes as Team Cymru said it identified five additional LegionRelay command-and-control (C2) servers used in attacks targeting Ukrainian entities. The IP addresses are listed below -
Vendors
Products
AndroidThe threats also extend to the Android ecosystem, with threat clusters UAC-0244 and UAC-0263 using decoy apps to deliver two different malware families -iOSThis includes the use of the DarkSword iOS exploit kit, which is distributed via watering-hole attacks through compromised legitimate Ukrainian news outlets and government sites to siphon sensitive data from compromisedMicrosoft Edgeexecution output. Infected machines then fetch these tasks using a hidden, off-screen instance of the Microsoft Edge browser as opposed to relying on a traditional downloader.Microsoft WordThe backdoor is delivered via macro-enabled Microsoft Word documents and communicates entirely through a webhook[.]site URL, which acts as a channel to stage tasks and to receive execution output. Infected machines thenRoundcube Webmaileffective – approaches," CERT-UA said. "In particular, attacks exploiting XSS vulnerabilities in the Roundcube webmail client were observed. Excel documents containing macros were also used to further distributeSOGoa security feature bypass in Microsoft Office, and CVE-2026-8496, a zero-click vulnerability in the SOGo webmail client, to deliver the COVENANT malware as well as siphon victims' mailbox credentials and data,
Tools
Countries
Romania2026 in connection with a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.RussiaThe Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty OrganizationSpainconnection with a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.Türkiyewith a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.UkraineIn a report published late last month, the Computer Emergency Response Team of Ukraine (CERT-UA) revealed that Russian hackers are increasingly targeting the smartphones belonging to Ukrainian military personnel and
Industries
GovernmentFuture Insikt Group in late August 2026 in connection with a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.Law enforcementTargets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the