Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
APT28 targets NATO naval shipbuilder with new reflective loader and HOOKEDGE backdoor.
The Russian state-sponsored threat actor APT28 has been linked to attacks against a NATO naval shipbuilder and other defense contractors in NATO countries. The group utilized a new reflective loader and the HOOKEDGE backdoor, employing techniques like credential theft and establishing persistent SSH tunnels.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HOOKEDGE?
Get an email when a new story names HOOKEDGE, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRussian state-sponsored threat actor APT28 infiltrated a NATO naval shipbuilder by deploying a novel reflective loader and the HOOKEDGE backdoor, combined with credential theft and persistent SSH tunnels to maintain long-term access. This attack highlights how nation-state adversaries specifically target defense industrial base organizations to extract sensitive military and technological intelligence. The use of persistent SSH tunnels demonstrates how attackers can blend into legitimate network traffic, making detection exceptionally difficult without robust monitoring. For defense contractors handling classified or sensitive NATO-related data, these breaches carry severe national security implications beyond typical corporate espionage.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 185.82.218.119
- malware — HOOKEDGE
- malware — Reflective Loader
- malware — ld.exe