Threat Intelligence
Russian GRU hackers breached NATO shipbuilder and defence firms in espionage campaign
Russian military hackers broke into a NATO shipbuilder, an aircraft engine maker, and a law enforcement agency in a targeted espionage campaign, according to Symantec.
Ross GrantUpdated 2 min read
The short version
A group of Russian military hackers broke into the computer systems of a NATO shipbuilder, a company that makes aircraft engines, and a law enforcement agency. They used a fake Word document to infect a shipbuilder's computer and then spent weeks exploring the network and stealing credentials. The goal was to gather secret information, not to steal money. Security experts say other defence companies should check their systems for signs of similar attacks.
By the numbers
- 2 monthsduration of the espionage campaignCybersecurity Dive
- 3number of confirmed targets: shipbuilder, aircraft engine maker, law enforcement agencyCyberScoop
What happened?
Russian military hackers linked to the GRU broke into the networks of a NATO shipbuilder, an aircraft engine manufacturer, and a law enforcement agency in a targeted espionage campaign, according to Symantec. The attackers, known as APT28 or Fancy Bear, used both familiar and new malware to steal credentials and map networks. The campaign lasted at least two months, with the first compromise at the shipbuilder traced to July 2026.
Who is affected
Symantec researchers say the targets included a naval shipbuilder, a manufacturer of military aircraft engines, and a law enforcement agency, all in countries that are members of NATO. The attackers also tried to breach other government agencies and critical manufacturers. The companies targeted play key roles in national security and defence policy, according to Symantec. The shipbuilder's network was compromised during a two-month campaign.
How the attack worked
The attackers, identified as APT28 (also known as Fancy Bear, Swallowtail, and Forest Blizzard), are linked to Russia's military intelligence agency, the GRU. Symantec observed "hands-on-keyboard" activity, meaning a human operator was actively controlling the attack rather than relying on automated malware. This included repeated access to a compromised host over a week to steal credentials. In the shipbuilder case, the attack began when an employee opened a malicious Microsoft Word document on 24 July 2026. The document delivered malware that established a communications link with the attackers, who then collected information about the machine and mapped the internal network. The malware remained active on the network until at least 24 September 2026.
What was taken
Symantec reported that the attackers stole credentialed material from the shipbuilder, but did not specify exactly what data was taken. The focus appeared to be on intelligence gathering rather than financial gain. The campaign is described as espionage, with the goal of collecting sensitive information from organisations linked to NATO defence and security.
The response
Symantec urged companies in similar sectors to scan their networks for signs of compromise and provided indicators of compromise for the malware and infrastructure used. The researchers highlighted the use of both known malware (Hookedge backdoor) and a new, previously undocumented loader (ld.exe) that decrypts its payload only at runtime, making analysis difficult. Symantec could not determine the purpose of the loader because the necessary decryption key was not recovered.
What you should do
Organisations in defence, aerospace, and government sectors should review Symantec's indicators of compromise and check for suspicious activity, especially if employees have opened unexpected attachments. Monitoring for unusual network mapping or credential access is recommended. Security teams should be alert for both known malware like Hookedge and new, custom tools.
Why it matters
This campaign shows that state-backed hackers are still targeting defence and government organisations for espionage. The use of both known and new malware makes detection harder. Companies supporting national security are at risk and need to stay alert for advanced threats.
Key points
- Russian GRU-linked hackers breached a NATO shipbuilder and other defence targets.
- Attackers used both known malware and a new, hard-to-analyse loader.
- The campaign focused on espionage, stealing credentials and mapping networks.
- The initial compromise came from a malicious Word document opened by an employee.
- Symantec urges similar organisations to check for signs of compromise.
Sources
CyberScoop
Reference
Cybersecurity Dive
Reference
