Russian APT28 Campaign Targeting NATO Defense Sectors

Russian state-sponsored actor APT28 (also known as Swallowtail, BlueDelta, and Forest Blizzard) has been attributed to a series of sophisticated intrusions targeting law enforcement, naval shipbuilders, and military aircraft engine manufacturers within NATO member states. These operations, identified by Symantec and multi-national government agencies, focus on the collection of strategic information regarding national security and defense logistics, particularly aid shipments to Ukraine.

The attack chain typically begins with spear-phishing and macro-enabled documents, leading to the deployment of the Hookedge backdoor and undocumented reflective loaders (ld.exe) designed for memory-only payload execution. Once inside, the actors demonstrate hands-on-keyboard activity, utilizing persistent SSH tunnels for internal network routing and custom PowerShell scripts for NTLM credential harvesting.

This campaign represents a significant threat to the defense industrial base and transportation sectors. The actor's ability to maintain long-term access through manipulated mailbox permissions and dedicated command-and-control infrastructure highlights a persistent espionage effort aimed at monitoring Western military assistance and defense capabilities.