Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

APT28, a Russia-linked threat actor, has been linked to attacks on two NATO member states. The attacks involved the use of a backdoor called HOOKEDGE. A new reflective loader was also deployed during the breach of a naval shipbuilder in one of the targeted NATO countries. The Symantec Threat Hunter Team is tracking this activity cluster, referring to it as Swallowtail. The attacks demonstrate APT28's continued targeting of NATO member states. The use of new tools, such as the reflective loader, suggests the group's ongoing efforts to evolve its tactics.