The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).
The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that’s supplied at runtime.
Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said.
“During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity,” Symantec said in a report shared with The Hacker News. “They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization’s internal network and deployed a previously undocumented reflective loader.”
APT28’s use of HOOKEDGE was first publicly documented by Recorded Future Insikt Group in late August 2026 in connection with a cyber espionage campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026.
HOOKEDGE shares significant code and tradecraft overlap with HEADLACE, a modular Windows implant that APT28 has put to use in attacks targeting diplomats since April 2023. Delivered via spear-phishing lures, HOOKEDGE is a barebones Windows batch script that’s capable of accepting attacker-issued commands and sending the results back.
The backdoor is delivered via macro-enabled Microsoft Word documents and communicates entirely through a webhook[.]site URL, which acts as a channel to stage tasks and to receive execution output. Infected machines then fetch these tasks using a hidden, off-screen instance of the Microsoft Edge browser as opposed to relying on a traditional downloader.
In the attack aimed at the naval shipbuilder in late July 2026, the threat actors are said to have delivered new variants of HOOKEDGE that abandon the use of webhook[.]site in favor of a dedicated IP address (“185.82.218[.]119:443”) for both tasking and exfiltration.
“The attackers used two distinct credential-theft techniques,” Symantec said. “In one, they pushed an SSH private key onto the compromised host and immediately used it to open an SSH connection back to their own server, requesting a persistent, backgrounded tunnel that would give them a route from their infrastructure into the target’s internal network.”
“In the other, they ran a short, self-contained PowerShell script that stands up a listener on the host’s own loopback address and forces the machine to authenticate to it, capturing the resulting NTLM handshake.”
The attackers have also been observed dropping a new reflective loader (“ld.exe”) using a curl command via SSH that’s engineered to decode and run a next-stage component. The exact nature of the payload remains unknown.
The most recent activity was registered on September 24, 2026, when a Visual Basic Script launcher associated with HOOKEDGE was observed within the shipbuilder’s network. It’s unclear if any data was stolen as a result of these intrusions.
“The tradecraft observed after initial access, credential theft through two independent techniques, a persistent network tunnel, and a previously undocumented loader, goes beyond the delivery mechanism that has so far been publicly reported on this campaign,” Symantec said.
Attacks Targeting Ukraine in H1 2026
In a report published late last month, the Computer Emergency Response Team of Ukraine (CERT-UA) revealed that Russian hackers are increasingly targeting the smartphones belonging to Ukrainian military personnel and government officials for espionage and financially motivated attacks.
“The growing role of smartphones in communications among military personnel, government employees, and civilians is making them more attractive targets for intelligence gathering activity, further compromise, and financially motivated attacks,” the agency said.
This includes the use of the DarkSword iOS exploit kit, which is distributed via watering-hole attacks through compromised legitimate Ukrainian news outlets and government sites to siphon sensitive data from compromised devices.
“The tool is associated with Russian threat actors, and its use against Ukrainian targets points to the adversary’s growing interest in the iOS platform, which had previously been considered relatively secure,” the agency noted.
The findings are consistent with a report from Google Threat Intelligence Group (GTIG) in March 2026, which linked the Russian espionage actor UNC6353 to the use of Coruna and DarkSword kits in watering-hole campaigns targeting Ukrainian users since summer 2025.
The threats also extend to the Android ecosystem, with threat clusters UAC-0244 and UAC-0263 using decoy apps to deliver two different malware families –
- UAC-0244 distributes CAMELSPY, which harvests device system information, geolocation, SIM card details, contacts, call logs, and images from the gallery.
- UAC-0263 distributes BTMOB RAT, which gives the threat actor control over the infected device and the ability to exfiltrate data.
CERT-UA also said it observed APT28 exploiting vulnerabilities such as CVE-2026-21509, a security feature bypass in Microsoft Office, and CVE-2026-8496, a zero-click vulnerability in the SOGo webmail client, to deliver the COVENANT malware as well as siphon victims’ mailbox credentials and data, respectively.
“At the same time, the actor has not abandoned older, tried-and-tested – but unfortunately still effective – approaches,” CERT-UA said. “In particular, attacks exploiting XSS vulnerabilities in the Roundcube webmail client were observed. Excel documents containing macros were also used to further distribute COVENANT.”
These attacks are among the 3,137 cyber incidents recorded by CERT-UA in the first half of 2026, which is estimated to be 8% more than in the second half of 2025.
The development comes as Team Cymru said it identified five additional LegionRelay command-and-control (C2) servers used in attacks targeting Ukrainian entities. The IP addresses are listed below –
- 91.149.221[.]118:8000
- 91.149.221[.]123:8000
- 166.88.239[.]54:8000
- 194.87.108[.]12:8000
- 194.87.108[.]217:8000
LegionRelay is the name assigned to a PowerShell-based RAT that supports file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, and RDP access setup. It’s attributed to a threat actor dubbed GREYVIBE, which is assessed to have engaged in persistent attacks targeting Ukraine and Ukraine-related entities since at least August 2025.
