Russian GRU Hackers Target NATO Defense Firms in Espionage Campaign

"Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine," Dick O'Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop.

Dick O'Brien's finding: human operators and deliberate targeting

Symantec's blog post reported active, repeated access to a compromised host at a NATO naval shipbuilder in which operators returned over the course of a week to steal credentialed material. O'Brien framed that pattern — "hands-on-keyboard" — as confirmation the organization was a deliberate target rather than an incidental infection. The observation indicates human decision-making at each step of the intrusion, not just automated malware activity, and it is the clearest signal Symantec cited that operators performed follow-on exploitation beyond initial access.

Targets: a NATO shipbuilder, a military aircraft-engine manufacturer, and a law enforcement agency

Symantec identified three specific types of victims in NATO countries: a naval shipbuilder, a manufacturer of military aircraft engines, and a law enforcement agency. The researchers said the attackers "apparently chose the targets of their attacks carefully," and that the activity reflected intelligence collection aimed at European government and defense targets. Symantec did not assign a public motive with certainty, though O'Brien speculated the campaign "could have been part of campaigns to target nations aiding Ukraine."

Threat actor: Swallowtail / APT28 / Fancy Bear / Forest Blizzard and links to the GRU

Symantec attributed the intrusions to the group variously known as Swallowtail, APT28, Fancy Bear and Forest Blizzard — a cluster of names Symantec and others use for actors with historical links to the Russian military agency GRU. The blog post tied the recent activity to that actor family and aligned the campaign with previous Western warnings that the group targeted companies supporting Ukraine.

Tools observed: the Hookedge backdoor and an undocumented loader, ld.exe

Researchers reported the attackers deployed the Hookedge backdoor, a tool Recorded Future's Insikt Group first identified in August. Recorded Future also observed attacks dating back to September of last year that used the same backdoor against defense and diplomatic targets in Romania, Spain and Turkey. Symantec additionally observed a previously undocumented loader named ld.exe. According to Symantec's analysis, ld.exe decrypts its payload in memory and requires a key supplied only at runtime on the command line; without both the encrypted file and the runtime key the payload cannot be recovered. Symantec did not recover the payload and therefore could not determine the loader's function.

Operational choices: dedicated servers, repeated credential theft, and a return to targets

Beyond the use of known and novel tools, Symantec highlighted operational behavior that sets this campaign apart from less targeted intrusions. O'Brien said investigators were surprised that "the attackers then moved their most sensitive follow-up activity onto a dedicated server, when Recorded Future had expected them to keep hopping between free services." In the shipbuilder intrusion, Symantec recorded hands-on-keyboard returns to a compromised host over a week specifically to steal credentialed material — a pattern consistent with credential harvesting followed by human-driven exploitation.

What this means for technologists, policymakers, and affected enterprises

• Technologists and security teams: Expect adversaries to combine known backdoors with novel loaders and to favor human-in-the-loop operations. Detection and response should prioritize signs of credential exfiltration, suspicious interactive sessions, and indicators associated with Hookedge and ld.exe.
• Policymakers and defense procurement leaders: The campaign targeted defense manufacturing and law enforcement entities in NATO countries, underscoring the need to treat supplier and partner networks as potential intelligence targets. Western warnings and public reporting of past campaigns — including a campaign that researchers and U.S. government agencies said they quashed this spring — form part of the operational backdrop for decisions about information sharing and protective measures.
• Affected enterprises (shipbuilders, aircraft-engine suppliers, and law enforcement agencies): The observed pattern of repeated returns by operators and the migration of sensitive follow-up activity to dedicated infrastructure suggest that an initial compromise can be followed by deliberate credential theft and extended exploitation. Organizations should assume motivated operators may seek privileged credentials and be prepared to investigate interactive sessions and unexplained outbound connections to unfamiliar servers.

The Symantec findings sketch a campaign that blends established tradecraft (a backdoor tied to prior activity) with experimental elements (an undocumented loader and a switch to dedicated servers) and human operators making live choices at infected hosts. Two concrete facts remain central and unresolved in the record Symantec published: the function of the ld.exe payload — which researchers could not recover — and the attackers' explicit motive beyond a general alignment with intelligence collection against European government and defense targets.

Original story on CyberScoop