cyber.hendryadrian.com
Security News · cyberscoop.com

Symantec Links APT28 to Espionage Campaign Against NATO Defense Firms and Police Agency

· Original article ↗

Summary

Symantec says APT28 compromised two defense firms and a law enforcement agency in NATO countries. The campaign used the Hookedge backdoor and an undocumented loader; researchers did not recover the loader’s payload.

Key points

  • Symantec attributed the campaign to Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, which it linked to Russia’s GRU.
  • Targets included a naval shipbuilder, a military aircraft-engine maker and a law enforcement agency in NATO countries.
  • At the shipbuilder, attackers repeatedly accessed a compromised host over a week and stole credentialed material, according to Symantec.
  • The hackers used the Hookedge backdoor; Recorded Future had previously observed the group using it against defense and diplomatic targets in Romania, Spain and Turkey.
  • Symantec also observed an undocumented loader that decrypts its payload in memory and requires a runtime command-line key. Researchers did not recover the payload, so its function is unknown.
  • A Symantec analyst said the campaign’s motive was uncertain and speculated it could involve targeting countries aiding Ukraine.

Article Details

Event Type
Espionage campaign involving compromises of two defense firms and a law enforcement agency in NATO countries.
Impact
Symantec reported hands-on-keyboard activity at a compromised naval shipbuilder, including repeated access over a week to steal credentialed material. The attackers also targeted a military aircraft engine manufacturer and a law enforcement agency. They used the Hookedge backdoor and an undocumented loader, ld.exe; the loader's payload function is unknown because researchers did not recover it.

People

Dick O'BrienPrincipal intelligence analyst at the Symantec Threat Hunter Team who commented on the campaign.

Threat Actors

APT28Name the article gives as an alias of Swallowtail, the group Symantec identified as responsible for the attacks.Fancy BearName the article gives as an alias of Swallowtail, the group Symantec identified as responsible for the attacks.

Malware

HOOKEDGEThe hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group.

Vendors

Recorded FutureThe hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group.Symanteclaw enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog post Tuesday.

Countries

RomaniaThat firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey.SpainThat firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey.TurkeyThat firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey.UkraineHe speculated that it could have been part of campaigns to target nations aiding Ukraine in its war against Russia.

Industries

DefenseRussian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog postLaw enforcementRussian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog post

Related Articles