Executive Summary
Russia's GRU-linked APT28 (also known as Swallowtail, Fancy Bear, and Forest Blizzard) recently targeted NATO member states, successfully breaching a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. The attackers maintained hands-on-keyboard access for at least a week, demonstrating a high level of persistence and direct operator interaction within the victims' internal networks.
The attack chain began with macro-enabled Microsoft Word documents delivering the HOOKEDGE batch script backdoor. Once inside, the actors established a persistent reverse SSH tunnel to bypass traditional network defenses and utilized a previously undocumented reflective loader (ld.exe) to execute encrypted payloads. The campaign also leveraged two recent vulnerabilities, CVE-2026-21509 in Microsoft Office and CVE-2026-8496 in the SOGo webmail client, to facilitate access and credential theft.
This activity highlights a significant threat to the defense industrial base and NATO supply chains. By utilizing legitimate web services for command and control and standard administrative tools like SSH and PowerShell for lateral movement, APT28 effectively blended their malicious activities with normal network traffic, making detection challenging for mid-sized industrial targets.