Russian‑Linked APT28 Breach at NATO Naval Shipbuilder Highlights Cyber Risk to Europe’s War Industry
A Russian‑linked group known as APT28 used a new malware loader and the HOOKEDGE backdoor to infiltrate a naval shipbuilder in a NATO country, stealing credentials and tunneling into its internal network in an operation that underscores how exposed Europe’s defense manufacturers are as they scale up for long‑term confrontation with Moscow.
A Russian‑linked hacking group has broken into the systems of a naval shipbuilder in a NATO country, raising pressure on Europe’s defense industry to secure its networks as demand for weapons and warships grows.
Security researchers say the group, widely referred to as APT28 or Fancy Bear, has been using a previously undocumented malware loader alongside a backdoor called HOOKEDGE in campaigns against organizations in two NATO states. At the naval shipbuilder, the attackers allegedly stole user credentials, set up a persistent SSH tunnel into the internal network, and then used the new loader to push deeper into the environment.
That sequence gives the group more than short‑term access. With valid credentials and a hidden tunnel, APT28 can monitor traffic, search for design files or emails, and scout systems used to plan and maintain naval platforms. There is no public indication so far that they reached classified material or disrupted physical operations, but the foothold itself is sensitive for a company that builds or services warships.
For staff inside such yards, an intrusion may appear only as tighter IT rules, unexplained changes to software or quiet visits from incident response teams. Behind the scenes, security teams have to assume that planning tools, configuration databases or supplier communications could be under observation or at risk of tampering.
Naval shipyards sit close to the core of NATO’s deterrent posture. They deliver and sustain vessels that enforce sanctions, escort tankers, patrol sea lanes and carry out missions from the North Atlantic to the Red Sea. Inside knowledge of their schedules, maintenance cycles or component shortages could give Russian intelligence useful insight into when particular ships are available and where bottlenecks might emerge.
Western governments have previously linked APT28 to intrusions against ministries, political parties and infrastructure. Targeting a naval shipbuilder fits a pattern in which Russia combines cyber operations with military pressure and information campaigns aimed at both state institutions and private firms.
The breach lands as European governments expand weapons production for Ukraine and for their own stocks. Le Monde reports that Slovakia has become a major ammunition supplier to Ukraine, with exports of military ammunition, parts and components reaching €2.1 billion in 2025, a year‑on‑year increase of 138.6%. A more active arms sector means more high‑value industrial networks for groups like APT28 to probe.
The lesson for defense manufacturers is straightforward: compromising a navy’s suppliers can be almost as useful as compromising the navy itself. Persistent access at a shipyard or munitions plant can feed a steady stream of data on capabilities and weaknesses.
In the near term, cyber defenders will be watching to see whether HOOKEDGE and the new loader appear in other parts of Europe’s defense supply chain, including aerospace and electronics. Public attribution by NATO governments, new sanctions on Russian cyber actors, or tougher security requirements imposed on shipyards and arms makers would signal that capitals see the incident as part of a broader campaign rather than an isolated case.
Sources
- OSINT