Symantec has attributed an espionage campaign against two defence firms and a law enforcement agency in NATO countries to Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard — the GRU-linked group behind the 2016 Democratic National Committee hacks. The targets chosen were a naval shipbuilder and a manufacturer of military aircraft engines; in the shipbuilder intrusion Symantec observed hands-on-keyboard activity as the operators repeatedly returned to a compromised host over about a week to steal credentialed material, which Dick O'Brien of the Symantec Threat Hunter Team said confirms a genuine, deliberate targeting rather than an opportunistic infection. The attackers used the Hookedge backdoor first documented in August by Recorded Future's Insikt Group, which had already seen the same group using it since September 2025 against defence and diplomatic targets in Romania, Spain and Turkey. Symantec also observed a previously undocumented loader, ld.exe, which decrypts its payload in memory and needs a key supplied only at runtime, so researchers could not recover or determine the payload's function. O'Brien tied the operation to broader intelligence collection against European government and defence targets.

• Source article