Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
Summary
The Russian state-sponsored threat actor APT28 has been linked to attacks against two NATO member states, compromising a naval shipbuilder. The group utilized a new backdoor named HOOKEDGE and a previously undocumented malware called Reflective Loader in these sophisticated attacks.
IFF Assessment
This incident represents a significant breach by a sophisticated nation-state actor against critical infrastructure within NATO, posing a direct threat to allied security.
Defender Context
This incident highlights the persistent threat posed by APT28 to NATO nations and critical infrastructure. Defenders should be aware of the group's evolving tactics, techniques, and procedures, particularly their use of new backdoors like HOOKEDGE and Reflective Loader, and ensure robust defenses are in place against sophisticated nation-state attacks.