[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3uiIf6QRn6MVAYXYuCKkvJiGi4x5Hye2ookZOY5N4Po":3},{"article":4,"iocs":55,"watch_terms":68,"solutions":69,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"fdf10757-53af-4c72-88d0-c115e102bca2","Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader","russian-apt28-breaches-nato-naval-shipbuilder-in-nato-country-deploys-new-reflec-a960a6","The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously","The Russian state-sponsored threat actor APT28 has been linked to attacks against a NATO naval shipbuilder and other defense contractors in NATO countries. The group utilized a new reflective loader and the HOOKEDGE backdoor, employing techniques like credential theft and establishing persistent SSH tunnels.","APT28 targets NATO naval shipbuilder with new reflective loader and HOOKEDGE backdoor.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Frussian-apt28-breaches-nato-naval.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgNLZ-1vEmoCyztDVMziqJlhZPTZfW4mOe-qDn6OxDQ-K2LVZTvqhoOe3MIip5bDJfiJd7e3HLcq4S-0xb2SlfWbEqp4vlvbOnQDSP5edsQIxHFtYSCt1qM7XZksq0NPZ9AGesx0YzqHsTeWUuPUTysC5dbuDOvKIjQW0DJvkg1UG9KLH2Doglq7WtgyiRM\u002Fs1600\u002Frussia-nato.jpg","2026-10-20T11:06:25+00:00","2026-10-20T14:24:35.350886+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"APT28","threat_actor",{"name":21,"type":19},"BlueDelta",{"name":23,"type":19},"Fancy Bear",{"name":25,"type":19},"Forest Blizzard",{"name":27,"type":28},"Swallowtail","campaign",{"name":30,"type":31},"HOOKEDGE","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62,65],{"type":57,"value":58,"context":59},"ip","185.82.218.119","Dedicated IP address used for HOOKEDGE tasking and exfiltration.",{"type":49,"value":30,"context":61},"Backdoor used by APT28.",{"type":49,"value":63,"context":64},"Reflective Loader","Previously undocumented loader deployed by APT28.",{"type":49,"value":66,"context":67},"ld.exe","Name of the reflective loader executable.",[30],{"controls":70,"vendors":151},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":130,"name":131,"problem":132,"products":133},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[134,142,143],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"apt28-breaches-nato-defense-contractor-using-reflective-loader-and-ssh-tunnels","APT28 Breaches NATO Defense Contractor Using Reflective Loader and SSH Tunnels","Russian state-sponsored threat actor APT28 infiltrated a NATO naval shipbuilder by deploying a novel reflective loader and the HOOKEDGE backdoor, combined with credential theft and persistent SSH tunnels to maintain long-term access. This attack highlights how nation-state adversaries specifically target defense industrial base organizations to extract sensitive military and technological intelligence. The use of persistent SSH tunnels demonstrates how attackers can blend into legitimate network traffic, making detection exceptionally difficult without robust monitoring. For defense contractors handling classified or sensitive NATO-related data, these breaches carry severe national security implications beyond typical corporate espionage.",[163,164,165,166,167,168,169],"MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":171,"MITRE ATT&CK T1566: Phishing":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"CIS Control 17: Incident Response Management":174,"CIS Control 13: Network Monitoring and Defense":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":177},"As a NATO defense supplier, the shipbuilder falls under critical infrastructure obligations requiring incident handling and security measures that would mandate controls directly countering APT28's persistent access techniques.","APT28 commonly uses spearphishing as an initial access vector; recognizing and blocking phishing attempts would likely have disrupted the initial foothold in this intrusion.","Timely remediation of vulnerabilities exploited during the initial compromise would have reduced the attack surface available to APT28 for deploying their reflective loader.","A mature incident response plan with pre-defined playbooks for nation-state intrusions would have enabled faster detection, containment, and eradication of APT28's HOOKEDGE backdoor and SSH tunnels.","Persistent SSH tunnels used by APT28 would have been detectable with continuous network traffic analysis and anomaly detection, limiting dwell time and data exfiltration.","A formal vulnerability management process applied to all defense contractor systems would have identified and closed the weaknesses leveraged by APT28 before exploitation occurred.","The credential theft component of this attack underscores the need for strong identity controls and MFA to prevent stolen credentials from enabling persistent access across defense systems."]