Russian state-linked hacking group APT28 has compromised a naval shipbuilding company in a NATO member state, maintaining access to its network for at least two months, according to cybersecurity researchers.
The intrusion was identified by Symantec’s Threat Hunter Team and forms part of a wider espionage campaign targeting organisations connected to defence and security across NATO countries.
The same campaign also targeted a law enforcement agency and a manufacturer of aircraft engines used in military equipment in two other NATO countries. Researchers have not disclosed the identities of the affected organisations or their locations.
APT28, also known as Fancy Bear, Forest Blizzard and Swallowtail, has long been associated with Russian cyberespionage operations.
The attack on the shipbuilding company began on 24 July 2026, when a malicious Microsoft Word document was opened from the Microsoft Outlook attachment cache. The document contained an obfuscated macro designed to assemble parts of its malicious code during execution, making it more difficult for conventional security tools to detect. Once activated, the malware launched Microsoft Edge in a hidden window and used the browser to execute commands aimed at gathering information about the compromised computer, its network configuration and running processes.
By 27 July, the attackers had established a more persistent connection to the company's internal network. Using Windows OpenSSH and SSH authentication keys, they created a background tunnel that allowed remote access to internal systems without relying on a conventional malware-based connection. The hackers also deployed a PowerShell script to intercept NTLM authentication and collect user credentials, potentially enabling them to move between systems and access additional resources.
Researchers observed the attackers testing connections to cloud services including Dropbox, Google, Microsoft and Mega, apparently assessing possible channels for transferring stolen information.
On 31 July, the intruders executed a previously undocumented malware loader named ld.exe alongside an encrypted file called Events.dat. The loader was designed to decrypt its payload directly in system memory using a command-line key, a technique that can complicate detection and forensic analysis. However, researchers were unable to recover the final encrypted payload and could not determine its intended function.
Although the last directly observed commands from the attackers were recorded on 31 July, malicious loaders remained active in the compromised environment through late August and were triggered again on 24 September. Investigators have not established whether the September activity resulted from automated malware execution or a renewed attempt by the attackers to access the network.
The findings illustrate the risks facing NATO's defence industrial supply chains, particularly companies involved in military shipbuilding and aerospace production.
The full extent of any information theft has not been established, and the researchers have not disclosed what sensitive data, if any, was obtained during the intrusion.
