Russia's Fancy Bear Spent Two Months Inside NATO Defense Firms, Symantec Reveals

By Hamza Faisal

Russia's military intelligence hackers spent about two months inside the networks of defence companies in two NATO countries, Symantec's Threat Hunter Team revealed this week, in an espionage campaign that reached a naval shipbuilder, a military aircraft engine manufacturer and a national law enforcement agency.

The group, which Symantec tracks as Swallowtail and the wider security industry knows as APT28 or Fancy Bear, is linked by Western governments to Russia's GRU military intelligence agency. Symantec disclosed the campaign on October 20, describing activity that ran from July 24 to at least September 24, 2026, and warning that it may still be ongoing.

Neither the countries nor the victim organisations were named. What Symantec did publish is a detailed picture of how the intruders got in, stayed in, and worked their way through a shipbuilder's network by hand.

A malicious Word document opened the door

At the naval shipbuilder, the intrusion began in July when an employee opened a malicious Word attachment, according to Symantec's account of the campaign. Over the following week, the attackers returned repeatedly to the compromised machine in what researchers described as hands-on-keyboard activity — a human operator at work, not automated malware running on its own.

The operators stayed for roughly four to five days of active work at the shipbuilder, stealing credential material using two separate techniques and opening a persistent reverse SSH tunnel into the organisation's internal network.

Symantec analyst Dick O'Brien told CyberScoop the hands-on activity was itself confirmation the organisation was a genuine target, not an accidental infection.

Hookedge and a loader nobody has fully seen

The campaign's centrepiece was Hookedge, a custom backdoor the attackers used to maintain access and run payloads. Recorded Future had previously observed the same group using Hookedge against defence and diplomatic targets in Romania, Spain and Turkey, suggesting the tool is a standing part of the group's kit rather than a one-off build.

Alongside it, the intruders deployed a previously undocumented reflective loader, a small program called ld.exe that decrypts and executes its payload directly in memory using a key supplied at runtime. Because nothing is written to disk in usable form, the technique is designed to slip past traditional file-based detection — security teams watching files alone would see little.

Symantec's researchers never recovered the loader's payload, so what it was ultimately built to do remains unknown. The full scope of any data taken from the three victims is likewise unconfirmed, and Symantec could not say whether sensitive designs or operational records left the networks.

Why these targets, and why now

The target set reads like a Russian intelligence shopping list: ship designs and production data from the shipbuilder, propulsion technology from the engine maker, and investigative records from the law enforcement agency. All three would be of direct interest to a foreign intelligence service, and Symantec analysts speculated the campaign could be connected to countries aiding Ukraine.

APT28 is one of the longest-running names in state hacking: the US government identifies it as a GRU unit, known since the 2016 attack on the Democratic National Committee, and its usual targets are military, defence and government organisations across Europe and North America.

For defenders, Symantec's report is a practical warning as much as a geopolitical one: block macros in Office documents arriving from outside, hunt for code that runs only in memory, and treat a single opened attachment as the possible start of a months-long human-operated intrusion, not a contained incident.