New research reveals that **APT28**, also known as **Fancy Bear**, **BlueDelta**, and **Forest Blizzard**, has been actively compromising European defense organizations. The attacks leverage a recently discovered backdoor named **Hookedge** to facilitate credential theft and network reconnaissance. ### Anatomy of an Attack One notable incident involved a naval shipbuilder, where hackers gained initial access in July after an employee opened a malicious **Microsoft Word** document attached to an email. Following the breach, the attackers systematically explored the company's internal network, specifically attempting to exfiltrate login credentials. Over the subsequent week, the threat actors repeatedly accessed a compromised machine, deploying a novel, previously undocumented tool. This tool is designed to decrypt and execute malicious code directly within the computer's memory, though its ultimate objective remains unclear. ### Campaign Duration and Objectives The earliest confirmed infection date was July 24, with related malicious activity detected as late as September 24. This timeline suggests the operation spanned at least two months, although researchers could not confirm uninterrupted access throughout this period. **Dick O'Brien**, an intelligence analyst at **Symantec**, noted that while it couldn't be definitively confirmed if sensitive information was stolen, "Given the nature of the targets, it's reasonable to assume that defense-related information was the objective of the attacks." He added, "In some cases, the attackers were on the network for a few weeks, which may have given them opportunities to obtain data." **Symantec** suggests that the specific selection of targets indicates these attacks are part of a broader Russian intelligence-gathering initiative focused on European government and defense entities. The continued activity observed in September further indicates the ongoing nature of this espionage campaign. ### APT28's Persistent Threat **APT28**, linked to Russia's military intelligence agency **GRU**, has a long history of conducting cyber-espionage operations. For over a decade, the group has targeted military, government, and defense organizations across Europe and North America. They gained significant notoriety in 2016 for their alleged involvement in the hacking of the **Democratic National Committee** ahead of the U.S. presidential election. Western cybersecurity agencies have consistently issued warnings regarding **APT28**'s efforts to compromise organizations involved in defense and military logistics, particularly those supporting Ukraine. Earlier this year, British security officials warned that **APT28** had exploited vulnerabilities in internet routers to redirect web traffic and spy on victims. Researchers also identified the group targeting maritime, transportation, and diplomatic organizations in countries including Poland, Slovenia, Turkey, Greece, and the United Arab Emirates. Last year, over 20 Western intelligence and cybersecurity agencies issued a joint advisory accusing **APT28** of targeting logistics providers and technology companies involved in delivering foreign assistance to Ukraine.