On 20 October 2026, Symantec's Threat Hunter Team reported that the Russian espionage group APT28, which it tracks as Swallowtail, targeted a naval shipbuilder, a manufacturer of military aircraft engines and a law enforcement agency in two NATO member states. At the shipbuilder, the attackers got in through a Word attachment on 24 July, stole login credentials, opened an SSH tunnel into the internal network and left tools behind that were still present in late September.
APT28, also known as Fancy Bear and Forest Blizzard, is assessed by the US government to be a unit of Russia's military intelligence service, the GRU. Symantec did not name the victims or the two countries. It also could not say whether sensitive data left the networks. What it did publish is a detailed, step-by-step record of how a state-backed team works once it is inside a defence manufacturer.
That record matters well beyond the three victims. Shipbuilders and engine makers depend on long chains of design offices, machine shops and component suppliers, and much of what a foreign intelligence service wants from them sits in engineering files: 3D models, drawings, specifications and test data. This article explains what Symantec found, why it is relevant to European engineering suppliers, and what to check this week.
TL;DR: APT28 inside a NATO naval shipbuilder, July to September 2026
Symantec says APT28 targeted a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in two NATO countries. At the shipbuilder, an employee opened a malicious Word attachment on 24 July 2026. The Hookedge backdoor ran reconnaissance within two minutes. Three days later an operator moved to a dedicated server, stole credentials in two ways and opened a persistent SSH tunnel into the internal network. On 31 July the attackers deployed a new loader whose encrypted payload Symantec could not recover. Its files were still present in late August, and the launcher was seen again on 24 September. Symantec could not determine whether data was stolen. Its advice: treat any Hookedge finding as a potentially ongoing intrusion and hunt for stolen credentials and tunnels, not only the first infection.
What did Symantec find?
The Symantec Threat Hunter Team report of 20 October 2026 describes a campaign against three organisations in two NATO member states. In Symantec's words: "The common thread across these targets is their relevance to national security and defense policy." The main findings are these.
- Three targets, two countries. A law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. All were in Europe. None is named.
- A known backdoor. The attackers used Hookedge, a backdoor that Recorded Future's Insikt Group first documented in August 2026 in attacks on government, defence and diplomatic organisations in Romania, Spain and Türkiye.
- Hands-on activity. At the shipbuilder, an operator returned to the same computer repeatedly over about a week, ran commands seconds apart and stole credential material.
- A change of infrastructure. Hookedge normally takes instructions through the free service webhook.site. At the shipbuilder, the second stage switched to a dedicated attacker server for both instructions and data uploads.
- A new loader. A previously undocumented tool, ld.exe, decrypts an encrypted file in memory using a key typed on the command line. Symantec did not recover the payload, so its purpose is unknown.
Symantec gives far less detail about the aircraft engine maker and the law enforcement agency. Nothing in the report says which systems the attackers reached at those two organisations.
How did the attackers get into the naval shipbuilder?
Through an ordinary email attachment. On the afternoon of 24 July 2026, an employee opened a Word document from the Outlook attachment cache. A heavily obfuscated macro dropped four small files into the user profile: a VBScript launcher, a pair of HTML files and a batch script. The batch script started a 1x1 pixel Microsoft Edge window placed far off screen and used it as a hidden web client to fetch commands from webhook.site, run them and upload the results.
About two minutes later, a reconnaissance script tested whether the computer could reach Dropbox, Google, Microsoft sign-in, MEGA and a hard-coded IP address, read the proxy settings, and listed logged-on users, running processes and the contents of the Downloads, Desktop, Documents and Program Files folders. Symantec suggests the connectivity checks helped the attackers choose a channel for moving data out.
After a gap of about three days, the same launcher reappeared on 27 July and a second stage began taking instructions from a dedicated server instead of webhook.site. A scheduled task kept it running. Within 30 seconds of the new session, seven commands ran 2 to 8 seconds apart, starting with whoami. Symantec analyst Dick O'Brien explained to CyberScoop why that pattern matters: "Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine," he said.
Why did they steal credentials and open an SSH tunnel?
Because a single infected laptop is only a starting point. The engineering data that matters in a defence manufacturer usually sits on file servers, PLM and PDM systems, and in mailboxes, behind other accounts. Symantec describes two ways the operator went after those accounts.
- An SSH tunnel. The attackers pushed a private SSH key onto the computer, hid it in a folder named after Adobe and used it to connect to their server as root. The connection created a persistent route from the attacker's infrastructure back into the shipbuilder's internal network. A lookup of an internal hostname followed at once.
- NTLM capture. A PowerShell script started a small web listener on the computer and then made the machine authenticate to itself. That captures NTLMv2 handshakes, which can be cracked offline or relayed to other systems.
The operator then checked group memberships and administrator rights, looked up further internal hosts, one apparently a mail server, and listed installed patches. On 28 July the SSH process was ended. On 31 July two files arrived: the ld.exe loader and an encrypted file called Events.dat. The loader and the VBS launcher were still on the machine about four weeks later, and the launcher ran again on 24 September, the latest activity in Symantec's data.
This pattern matches what we described in our recent analysis of China-linked hackers for hire targeting CAD and PLM data: state-backed teams rarely need exotic exploits when a document, a stolen password and a quiet tunnel will do.
Was any engineering data stolen?
Nobody outside the victims knows. The Record reports that the researchers could not determine whether sensitive information was stolen, while O'Brien said the attackers were on some networks for a few weeks and that defence-related information was presumably the objective. Symantec does not mention CAD, PLM or any specific engineering system, and this article does not assume that design files were taken.
What is clear is what such companies hold. A naval shipbuilder works with hull and system models, drawings, supplier specifications and test results. A military engine maker holds some of the most closely guarded design and manufacturing data in industry. Our guide to aerospace CAD file security and defence contractor requirements sets out why these files are such attractive targets and why many contracts require controls on them.
Why should European engineering suppliers care?
Because they are part of the same target set. Symantec describes the campaign as consistent with a broad collection effort against European government and defence organisations. Western agencies have also warned that the group targets logistics and technology companies supporting Ukraine.
Cyber operations are only one channel. Three days ago we reported on the suspected Russian spy arrested in Germany over defence industry contacts, who allegedly gathered information on tank, ammunition and explosives production. For small design offices, the uncomfortable lesson is that a contract with a shipyard or an engine maker can make you a target too.
There is a regulatory side too. Since 11 September 2026, makers of products with digital elements must report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act reporting rules. Many defence suppliers also face contractual security clauses. A slow, quiet intrusion like this one is exactly the kind of event that is hard to scope, and hard to report accurately, without good logs.
Make stolen design files useless to whoever takes them. CADChain encrypts CAD files at file level, sets per-file permissions and logs every access with blockchain timestamps, across CAD systems and suppliers.
👉 See how CADChain protects CAD files
What can file-level protection do once attackers are inside?
Most defences against this campaign work at the edge: blocking macros, spotting a hidden browser window, catching an SSH tunnel. They should come first. But this operator got past the edge and held access for weeks. So what protects the design files themselves when the network can no longer be trusted?
File-level controls do not stop a phishing email. They change what an attacker gets afterwards. If a CAD file is encrypted, not just access-controlled, a copy pulled through a tunnel is unreadable without a separate permission tied to that file. If every open is logged, auditing CAD file access shows which models were opened, by which account and when, which is exactly the question Symantec could not answer from the outside. And tamper-proof audit trails keep those records reliable even if an attacker gains administrator rights on the file server.
The same principle sits behind a zero-trust model for CAD file distribution: each supplier, engineer and system gets only the files and rights it needs, for as long as it needs them, and every use leaves a trace.
What should defence and engineering teams do now?
- Run the published indicators. Symantec published file hashes and network indicators for Hookedge, its launchers, the loader and the dedicated server. Ask your security team or provider to search mail, endpoints and network logs going back to at least July 2026.
- Treat any match as live. Symantec's advice is to treat a Hookedge finding as a potentially ongoing intrusion. Look for the credential theft and tunnelling it describes, not just the first infected machine.
- Block Office macros from the internet and review who still needs macros at all. Engineering teams often keep old macro-based templates; move them to signed, managed locations.
- Block outbound SSH from office and engineering workstations unless there is a named business reason, and alert on new SSH keys in unusual folders.
- Restrict NTLM where you can and enable protections against relaying, so captured handshakes are worth less.
- Map where design data lives: file servers, PLM and PDM vaults, mailboxes, cloud shares and supplier portals. You cannot scope an incident in systems you have not listed.
- Protect the most sensitive CAD files at file level: encryption, per-file permissions for each partner, and access logs that survive an administrator account being stolen.
- Agree incident terms with customers and suppliers now: who must be told, how fast, and what evidence you will need to show which files were or were not accessed.
For more detail, see our guides to industrial espionage and CAD file theft tactics, CAD protection strategies for automotive, aerospace and medical devices, view, edit, print and export permission levels, ransomware attacks on engineering firms and preventing CAD file exfiltration. Recent incidents show how many routes lead to engineering data: Oracle Agile PLM vulnerabilities, a CVSS 10 GitLab flaw in design repositories, the Loxone breach of partner and support systems and malicious DXF and DWG files.
How does this fit the bigger picture?
This week our sister sites looked at the same question from other angles: who can reach your design data, and how you prove what is yours.
- Sharing with suppliers. SOLIDWORKS Design 2027 adds cross-company collaboration, where an administrator enables external invitations and suppliers work in a shared space with their own licences. Read what SOLIDWORKS 2027 supplier collaboration changes for data control on solidboris.com.
- Proving design protection. In Range of Motion v. Armaid, the Chief Justice extended the deadline for a Supreme Court petition on how functional features are treated in design patent cases. Our sister site explains what the design patent functional features case means for Inventor teams.
- Proof that holds up. A researcher showed that C2PA Content Credentials could carry a valid signed timestamp over zero bytes of the actual file. Blended BORIS looks at what the Content Credentials timestamp flaw means for 3D artists.
Conclusion
Symantec's report is not about a spectacular exploit. It describes a Word attachment, a hidden browser window, a stolen key, a tunnel and a loader that waited. That was enough for a GRU-linked team to work inside a NATO naval shipbuilder for days and keep a foothold for weeks, while the defenders still cannot say what, if anything, was taken.
For European engineering suppliers, the response has two parts. Close the doors this campaign used: macros, outbound SSH, NTLM, unreviewed scheduled tasks. And assume that one day someone will get through anyway, so protect the design files themselves and keep records good enough to answer the hardest question after an incident: which files did they open?
Know exactly who opened every design file. CADChain gives engineering and defence supply chains file-level encryption, per-file permissions, access logs and blockchain proof of ownership for CAD files, across CAD systems, partners and suppliers.
👉 Protect your CAD files with CADChain
FAQ: the APT28 attack on a NATO shipbuilder
What did Symantec report on 20 October 2026?
That the Russian espionage group Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, targeted a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in two NATO member states, and how the shipbuilder intrusion worked.
Which companies and countries were affected?
Symantec did not name them. It says the targets were in two NATO member states, and The Record reports that all of them were in Europe.
How did the attackers get in?
At the shipbuilder, through a macro-enabled Word document sent as an email attachment and opened on 24 July 2026. It installed the Hookedge backdoor.
Was any data stolen?
Unknown. The researchers could not determine whether sensitive information was stolen, and the payload of the new loader was not recovered.
Is the campaign over?
Not necessarily. The launcher was seen again on 24 September 2026, and Symantec advises treating any Hookedge finding as a potentially ongoing intrusion.
What should a small engineering supplier do first?
Search for the published indicators, block internet macros and outbound SSH from workstations, list where design data lives and protect the most sensitive CAD files at file level.
How can CADChain help?
CADChain encrypts CAD files, sets per-file permissions for each user and partner, and logs every access with blockchain timestamps, so stolen copies are unreadable without permission and you can show which files were opened.
