Russia-Linked Hackers Target European Defence Firms and Police Using Malicious Word Attachment

Russian state-linked hackers targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two NATO countries, according to cybersecurity firm Symantec. The activity is attributed to APT28, a group linked to Russia's military intelligence agency, the GRU. Symantec did not name the countries or the organisations, saying only that the victims were in Europe.

The attackers used a recently discovered backdoor called Hookedge to get into systems, steal credentials and gather information about victims' networks. Recorded Future's Insikt Group first documented the malware in August. In one case, a shipbuilder was breached in July after an employee opened a malicious Microsoft Word document sent as an email attachment. The hackers then explored the internal network and tried to steal login details. Over the following week they repeatedly returned to a compromised computer and deployed a previously undocumented tool that decrypts and runs malicious code directly in memory. Its ultimate purpose is unclear.

The first confirmed infection was on July 24, and related activity was seen as late as September 24, so the operation spanned at least two months. Researchers could not confirm whether access was continuous or whether sensitive data was stolen. Symantec analyst Dick O'Brien said it is reasonable to assume defence information was the goal, and that continued activity after the August findings suggests the campaign is ongoing.