A recent cyber espionage campaign has targeted key defense contractors and a law enforcement agency in two NATO countries, according to cybersecurity firm Symantec. The attacks have been attributed to APT28, a hacking group linked to Russia's military intelligence agency, the GRU. While the specific countries and organizations remain undisclosed, it is confirmed that the affected entities are located in Europe.

The hackers leveraged a backdoor known as Hookedge to infiltrate systems, exfiltrate credentials, and gather sensitive information. This malware was first documented by Recorded Future's Insikt Group in August. In one notable incident, a naval shipbuilder was compromised after an employee opened a malicious email attachment. The attackers then explored the internal network and attempted to harvest login credentials.

The intrusion timeline indicates that the first confirmed infection occurred on July 24, with malicious activity continuing until at least September 24. Despite the extended presence, researchers could not determine if sensitive data was conclusively stolen. However, given the nature of the targets, it is believed that defense-related information was the primary objective.

This campaign is seen as part of a larger Russian intelligence effort aimed at European government and defense sectors. The ongoing nature of the attacks, observed as late as September, suggests that this espionage activity is still active. APT28, also known as Fancy Bear, has a long history of targeting military, government, and defense organizations globally, gaining notoriety for its operations against the Democratic National Committee in 2016.

Western cybersecurity agencies have frequently warned about APT28's focus on compromising entities involved in defense and military logistics, especially those supporting Ukraine. This activity underscores the persistent cyber threat posed by state-linked actors and the importance of robust cybersecurity measures for organizations in critical sectors.