Fancy Bear Breaches NATO Shipbuilder

Russia-linked APT28 hackers successfully entered a NATO-member shipbuilder’s network after an employee opened an infected Microsoft Word document. The attackers used the foothold to communicate with the compromised machine, collect information, and map the company network as part of a wider espionage campaign against European government and defense-related organizations.

Key findings

• APT28, also known as Fancy Bear, successfully compromised a shipbuilder in a NATO member state.
• The group delivered Hookedge malware through infected Microsoft Word documents.
• An employee opening a malicious document triggered malware that connected the victim machine to the attackers.
• Attackers collected information about the computer and its files, then began mapping the shipbuilder’s network.
• The campaign also targeted a law-enforcement agency and an aerospace-engine manufacturer, indicating a broad espionage focus on European government and defense-related targets.

Who’s being targeted

• Commonly targeted roles: Shipbuilding employees, Defense manufacturing employees, Aerospace employees, Government personnel, Law-enforcement personnel, Employees who receive external documents or attachments.
• Affected industries: Shipbuilding, Defense manufacturing, Aerospace engine manufacturing, Government, Law enforcement.
• Attack channels: email.
• Impersonated: A trusted business, government, or defense-sector contact.

Awareness takeaways

• Treat unexpected Microsoft Word attachments as suspicious, especially when the sender or business context cannot be independently verified.
• Report suspicious documents promptly rather than opening them; one opened attachment can give attackers a starting point inside the organization.
• Give extra scrutiny to unsolicited documents involving defense, government, aerospace, or national-security work, as these sectors can be targeted for espionage.

Red flags to watch for

• An unexpected Word document from an unverified or unfamiliar sender.
• A document request that is unrelated to the recipient's usual work or arrives without context.
• A prompt to enable content, macros, or editing after opening the document.