Russian Military-Linked Hackers Target Defence Firms and Law Enforcement in NATO Countries

Symantec researchers have reported that a Russian government-connected hacking group compromised two defence companies and a law enforcement agency in NATO countries as part of an espionage campaign. The group, known as Swallowtail, APT28, Fancy Bear and Forest Blizzard, is linked to the GRU, Russia's military intelligence agency, and is also known for the 2016 hacks of the Democratic National Committee.

The targets appear to have been chosen carefully: a naval shipbuilder, a manufacturer of military aircraft engines and the law enforcement agency. At the shipbuilder, Symantec saw "hands-on-keyboard" activity, where the attackers repeatedly returned to a compromised computer over a week to steal credential material. Symantec's Dick O'Brien explained this means a human operator is choosing each next step rather than malware running a fixed routine. In his view, it confirms the organisation was a genuine target and that further exploitation was at least attempted.

O'Brien said the campaign reflects broader intelligence collection against European government and defence targets, though the motive is not certain. He speculated it could be linked to efforts to target nations aiding Ukraine. The attackers used a backdoor called Hookedge, first identified in August by Recorded Future's Insikt Group, which had seen the same group using it against defence and diplomatic targets in Romania, Spain and Turkey. Symantec also observed a previously undocumented loader being deployed.