Russian GRU Hackers APT28 Breach NATO Shipbuilder and Aircraft Engine Maker

Russian military intelligence-linked hackers known as APT28, Fancy Bear, Swallowtail, and Forest Blizzard compromised two defense contractors and a law enforcement agency in NATO member countries during an espionage campaign identified in recent months, Symantec researchers reported Tuesday. The targeted organizations included a naval shipbuilder and a military aircraft engine manufacturer. During the intrusion at the shipbuilder, Symantec observed human "hands-on-keyboard" operators repeatedly returning to a compromised host over the course of a week to take credentialed material. The attackers used the Hookedge backdoor, which Recorded Future's Insikt Group first identified in August following attacks dating back to September of the previous year against defense and diplomatic targets in Romania, Spain, and Turkey. Symantec also discovered the group shifting its sensitive follow-up activity to a dedicated server rather than hopping between free services, deploying a previously undocumented loader named ld.exe that decrypts its payload in memory only when supplied with a runtime command-line key. "Without both the encrypted file and the key, the payload can’t be recovered. We didn’t recover it, so we don’t know its function." — Dick O’Brien, Principal Intelligence Analyst at the Symantec Threat Hunter Team.