- Symantec links attacks on a naval shipbuilder, an aircraft engine maker and a law enforcement agency in two NATO countries to APT28, a group tied to Russian military intelligence.
- The campaign spanned at least two months from July 24. In some cases attackers stayed on a network a few weeks. Symantec could not confirm data theft.
- Leaders should ask whether their teams could say how long an intruder was inside, and how quickly new threat reports reach defenders.
A campaign's length is not an intruder's stay
Reports on hacking campaigns often give one number: how long it lasted. That number is easy to misread. A campaign is a span of activity across several targets. It does not say how long anyone was inside one network.
A new Symantec report on APT28 shows the gap. Symantec links the group to Russia's military intelligence agency, the GRU. Fancy Bear, BlueDelta and Forest Blizzard are other names for the same group. The Record reported the findings.
The victims were a firm that builds ships for navies, a maker of military aircraft engines and a law enforcement agency. They are in two NATO countries. Symantec did not name the countries or the organizations. It said only that they were in Europe.
What Symantec measured
The first confirmed infection came on July 24. The latest related activity Symantec saw was on September 24. From those dates, Symantec says the operation spanned at least two months.
Symantec could not say whether the attackers kept access the whole time. So two months describes the campaign. It does not describe time inside any one victim.
The only time inside a network that the report gives is shorter. Symantec analyst Dick O'Brien told Recorded Future News that in some cases the attackers stayed a few weeks. He said that may have given them "opportunities to obtain data."
How the attack worked
At the shipbuilder, the way in was simple. A staff member opened an email attachment in July. It was a booby-trapped Word document. The report describes no advanced exploit for this step.
The attackers used a backdoor called Hookedge. A backdoor is hidden software that lets an outsider return to a computer. Recorded Future's Insikt Group first documented it in August. Symantec says the attackers used it to gain access, collect logins and learn about victims' networks.
At the shipbuilder, they explored the internal network and tried to steal login credentials. Stolen logins matter because they let an outsider move like a member of staff.
Over the next week, the attackers came back to one compromised computer several times. There they placed a tool nobody had documented before. It unscrambles malicious code and runs it in the computer's memory. Code run this way need not be saved as a file, which can give security tools less to scan. Symantec could not say what the tool was ultimately for.
What is still unknown
Symantec could not determine whether the attackers stole sensitive data. O'Brien said that, given the targets, it is reasonable to assume the goal was defense-related information. That is an assessment. It is not a confirmed loss.
Symantec reads the choice of targets as part of a wider Russian effort to gather intelligence on European government and defense bodies. O'Brien said activity continuing in September, after Recorded Future's August findings, suggests the campaign is ongoing.
That detail carries a lesson. Activity went on after a public report on the malware appeared. A warning helps only the teams that act on it.
Western agencies have warned for some time about APT28's interest in defense and military logistics, especially firms supporting Ukraine. Last year, more than 20 Western intelligence and cyber agencies issued a joint advisory. It accused the group of targeting logistics and technology firms that helped deliver aid to Ukraine.
The question to put to your team
This case shows that the number that matters is time inside a network. Defenders call it dwell time: the span between entry and discovery. It limits what an intruder can reach. Even Symantec could not fully establish it here.
Five questions follow from the case.
First: if someone returned to one of our computers several times in a week, would an alert fire? Who would see it?
Second: if we found an intruder today, could we say when they arrived and whether access was continuous?
Third: how long does it take for a new report on a malware family, like Hookedge, to reach the people who hunt for it in our systems?
Fourth: if one login is stolen, how far can it travel?
Fifth: for suppliers in defense and related industries, what do contracts say about incident reporting and how fast access can be cut?
A campaign may run for months. What leaders can control is how quickly they notice, and whether they can later say how long the intruder was there.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
