Adversary Intelligence — 2026-10-21

Russian GRU Hackers Compromise NATO Shipbuilder and Military Aircraft Engine Maker in Espionage Campaign Using Novel Backdoor

BLUFSwallowtail's sustained hands-on access to a NATO shipbuilder signals GRU prioritization of naval industrial targets, and the unrecovered loader payload leaves the full scope of compromise unknown.

Symantec's Threat Hunter Team reported on October 20 that Swallowtail (APT28, Fancy Bear, Forest Blizzard) targeted a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two NATO member states 1. At the shipbuilder, Symantec observed hands-on-keyboard activity over a week and an intrusion lasting at least two months, starting with a macro-enabled Word document opened on July 24 that installed the Hookedge backdoor 12. Operators stole credentials, including an NTLM capture via PowerShell, and opened a persistent SSH tunnel to their own server 1. Symantec also found a previously undocumented loader, ld.exe, but did not recover its encrypted payload, so its function is unknown 12. CyberScoop quoted Symantec's Dick O'Brien saying the motive is uncertain 2.

Analysis
Swallowtail's dedicated server and persistent SSH tunnel at a NATO naval shipbuilder mark a shift from disposable cloud staging to operator-controlled infrastructure. A week of hands-on-keyboard activity and an NTLM credential capture show the shipbuilder was a chosen target, not collateral. Defenders at other naval and aerospace suppliers should hunt for off-screen Edge launches, webhook.site traffic and unexpected ssh.exe sessions. The undocumented ld.exe loader remains unexplained because its encrypted payload and key were never recovered, so data theft is unconfirmed. The campaign may instead be opportunistic collection against any reachable defense supplier, not a focused effort tied to Ukraine support. Confidence is high, resting on Symantec's primary host-level reporting. CyberScoop and The Hacker News repeat it and add little independent corroboration, and the loader's function is the only gap.

3 sources

Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries - Symantec (Broadcom) Threat Hunter Team
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign - CyberScoop
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader - The Hacker News