APT28 Swallowtail espionage campaign targets defense firms and law enforcement in two NATO countries

Symantec's Threat Hunter Team disclosed on October 20, 2026 that the Russian espionage group it tracks as Swallowtail (APT28, also called Fancy Bear and Forest Blizzard, a unit of Russia's GRU military intelligence agency) targeted organizations in two NATO member states: a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines. The intrusions used the HOOKEDGE backdoor, delivered through macro-enabled Word documents. The first confirmed infection, at the naval shipbuilder on July 24, 2026, came from a malicious Word document opened from an email attachment, and related activity was detected through September 24, 2026. The two countries and the targeted organizations were not named.

At the naval shipbuilder, the operators returned to a compromised host repeatedly over the course of a week in hands-on-keyboard activity. They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network, and deployed a previously undocumented reflective loader, ld.exe, which decrypts its payload and runs it in memory using a key supplied only at runtime; the payload itself was not recovered, so its function is unknown. Symantec analyst Dick O'Brien told Recorded Future News that researchers could not determine whether the attackers succeeded in stealing sensitive information, and that given the nature of the targets it is reasonable to assume defense-related information was the objective.

Sources: Symantec; The Hacker News; The Record