APT28, a Russia-linked state-sponsored threat actor, breached a NATO naval shipbuilder in a targeted cyber-espionage campaign. The attackers used a backdoor called HOOKEDGE and a new reflective loader to steal credentials and open a persistent SSH tunnel.
The vulnerability or weakness
Not stated in the sources.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
The breach could result in the theft of sensitive information, disrupt operations, and compromise national security. The stolen credentials and persistent access could lead to further data breaches and loss of intellectual property.
Industries affected
Defense and aerospace industries are affected, as they hold critical information for national security.
Users affected
Employees of the targeted organization may have their credentials stolen, leading to potential unauthorized access to internal systems and data.
Build these skills
Sources
- Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign (CyberScoop)
- Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader (The Hacker News)
