Russian-linked hackers tunneled into NATO shipbuilder’s network, Symantec says

Russian-linked hackers stole credentials and opened a tunnel into a naval shipbuilder’s internal network during an espionage campaign that also targeted a military aircraft-engine maker and a law-enforcement agency, Symantec disclosed on October 20.

The security company attributed the activity to Swallowtail, also known as APT28 or Fancy Bear. It identified targets in two NATO member states. The Record, which interviewed a Symantec analyst, said the victims were European; their names and countries were withheld.

At the shipbuilder, the first confirmed infection followed the opening of a malicious Word attachment on July 24. Symantec’s account describes operators returning repeatedly during the following week, collecting credential material and mapping computers inside the organisation. A network tunnel gave them a route back through the compromised machine.

The attackers also deployed an undocumented loader that decrypted and executed a separate payload in memory. Investigators recovered the key and the encrypted file’s name, but the payload itself was missing. Its ultimate function remains unknown.

Traces appeared as late as September 24. That two-month span establishes the duration of observed activity; researchers could not establish uninterrupted access across the period. Symantec said later traces could reflect recurring tasks or renewed attention from the operators.

Dick O’Brien, a Symantec intelligence analyst, told The Record that researchers could not determine whether sensitive information had been stolen. He considered defence-related information a reasonable assumed objective given the victims, and said weeks on some networks could have created opportunities to obtain it.

The case leaves European defence suppliers facing a documented intrusion with an unresolved account of data loss. Symantec’s findings establish access, credential theft and new tooling; the assessment of the attackers’ collection objectives remains attributed to the researchers.