Skip to content
Russian APT28 Targets NATO Defense Contractors with Hookedge Backdoor

Russian APT28 Targets NATO Defense Contractors with Hookedge Backdoor

First seen 20 Oct 2026, 11:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 13:21 UTC
  • •APT28 targeted defense contractors in two NATO countries using the Hookedge backdoor.
  • •Attack methods included credential theft and persistent access via SSH tunnels.
  • •The operation is part of a broader Russian intelligence-gathering effort in Europe.

APT28, a Russian espionage group, targeted a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency in two NATO countries. The attacks utilized the Hookedge backdoor, first documented in August 2026, to gain access to the victims' systems, steal credentials, and gather sensitive information. The initial infection occurred when an employee opened a malicious Microsoft Word document in July 2026. Attackers maintained access for at least two months, with repeated visits to the compromised systems. The operation is part of a broader Russian intelligence-gathering effort focused on European defense organizations. Symantec confirmed the ongoing nature of the campaign, with activity noted as late as September 2026. The specific identities of the targeted countries and organizations remain undisclosed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-24
First confirmed infection reported
An employee opened a malicious Word document, leading to the initial compromise of the naval shipbuilder's network.
Therecord.Media
2026-09-24
Malicious activity detected
Related malicious activity was observed, indicating the attackers may have maintained access for an extended period.
Therecord.Media
2026-10-20
Attack details published
Security reports detailed the espionage campaign, confirming the involvement of APT28 and the use of the Hookedge backdoor.
Security

More articles in this cluster (3)

Following this threat?

Track APT28 and Hookedge in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (41)

1 / 3

Common questions

What organizations were targeted?
The specific organizations targeted include a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency in two NATO countries.
How did the attackers gain access?
Access was gained through a malicious Microsoft Word document that an employee opened, which initiated the compromise.
Is the attack ongoing?
Yes, the espionage campaign is ongoing, with related malicious activity detected as recently as September 2026.