Russian GRU hackers targeted a warship shipyard and an aircraft engine maker in two NATO countries

The Russian cyber-espionage group APT28, also known as Fancy Bear or Forest Blizzard, has targeted organisations in two NATO member states, among them a warship shipyard, a military aircraft engine manufacturer and a law enforcement agency. The operation was revealed by Symantec’s (Broadcom) Threat Hunter team in a technical analysis published on October 20, which does not name the countries or the companies.

Symantec tracks the group as Swallowtail. According to the US government it is a unit of Russia’s military intelligence service, the GRU, that mainly targets military, defence and government bodies in Europe and North America, and it became widely known in 2016 with the attack on the US Democratic National Committee. “All three targets likely held information of direct interest to a foreign intelligence service,” the company notes.

Two months inside the shipyard

The most extensive activity was recorded at the shipyard, where the intrusion lasted at least two months. The attackers repeatedly returned to a compromised computer over a week, in what looked like manual activity. They stole credentials with two different techniques: the first was planting a private SSH key and opening a permanent “tunnel” from their own server to the company’s internal network. The second was a PowerShell script that forces the computer to authenticate to a local “listener”, so that the NTLM handshake is captured.

The main tool was the Hookedge backdoor, first described by Recorded Future’s Insikt Group in August 2026. It arrives through Word documents with macros and communicates exclusively through the webhook.site service, using a hidden, off-screen Microsoft Edge window to receive commands. At the shipyard, a second stage of Hookedge abandoned webhook.site for a dedicated IP address of the attackers. A previously unknown tool, ld.exe, was also deployed, which decrypts and executes its payload directly in memory, with a key supplied only at the moment of execution.

The disclosure adds to a series of warnings about Russia’s “shadow war” against Europe, which the head of Germany’s BND intelligence service has also spoken about. For countries with naval shipbuilding programmes under way, such as Greece with the new Hellenic Navy units, the choice of a shipyard and an engine maker as targets shows that the defence industry is at the centre of the GRU’s interest.