APT28 Deploys New Reflective Loader in NATO Naval Shipbuilder Breach

The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).

The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously undocumented reflective loader technique. The attacks targeted a NATO naval shipbuilder located in two unspecified NATO member states. The reflective loader is designed to evade traditional detection mechanisms by loading malicious code directly into memory, avoiding writes to disk. Alongside this, the HOOKEDGE backdoor was deployed to establish persistence and facilitate command-and-control communications.

Symantec attributes the operation to APT28, a group with a history of targeting governmental and defense-related entities. The initial access vector is believed to involve supply chain compromise or credential theft, though specific details regarding the exact mechanism remain limited in the reported snippet. The attacks occurred in October 2026 and underscore the persistent risk to defense-critical infrastructure.

The Symantec report notes that no specific patch is available, as the issue pertains to novel evasion techniques rather than a software vulnerability. Mitigation recommendations focus on monitoring for reflective loader behavior, identifying HOOKEDGE indicators, and reinforcing supply chain security and credential hygiene across defense-related networks.