Russian hacking group APT28 (also known as Fancy Bear, Forest Blizzard, or Swallowtail) has successfully carried out a cyberattack on a naval shipbuilding company in a NATO member country. According to security researchers, the attackers remained undetected within the network for at least two months.
Russian hacking group APT28 (also known as Fancy Bear, Forest Blizzard, or Swallowtail) has successfully carried out a cyberattack on a naval shipbuilding company in a NATO member country. According to security researchers, the attackers remained undetected within the network for at least two months.
This attack is part of a broader espionage campaign in which the Russians also targeted a law enforcement agency and a manufacturer of aircraft engines for military equipment in two NATO countries. The names of the affected organizations and countries are not disclosed in the report by analysts from Symantec Threat Hunter Team, Cyber Press writes .
The attack began on July 24, 2026, when the system was compromised by opening an infected Word document directly from the Microsoft Outlook attachment cache.
To successfully penetrate, the document contained a disguised macro, the code fragments of which were assembled directly at runtime, which allowed attackers to easily bypass static checks of protective systems. After that, the macro secretly restarted the Microsoft Edge browser in an off-screen window, using it to load the first commands designed to scout the system, check network settings, and analyze running processes.
Already on July 27, the hackers took active action and deployed their own infrastructure: using SSH keys and the standard Windows tool OpenSSH, they created a background tunnel, gaining direct access to the company's internal network.
During the attack, the attackers used a special PowerShell script to intercept NTLM authentication and collect user credentials. In addition, the hackers checked the availability of popular cloud services (Dropbox, Google, Microsoft, Mega) for further information leakage.
On July 31, a previously undocumented reflective loader, ld.exe, was launched on an affected machine along with an encrypted Events.dat file. A special command-line key was required to decrypt it in RAM. Since the final encrypted module could not be removed, analysts have not yet determined its final destination.
Despite the fact that the last direct commands from operators were recorded on July 31, the malware downloaders remained active on the network in late August and were reactivated on September 24. Researchers are currently investigating whether this was a planned automatic operation of the program or a return of hackers to the system.
