CuraSec

tag: Apt28 · 2 items

Plan APT28 Hits NATO Naval Shipbuilder With New HOOKEDGE Backdoor
2026-10-20 · The Hacker News · source ↗ #apt28#nation-state#defense-sector
  • Engineer — Learn: No CVE or patch surface — this is new adversary tradecraft (reflective loader, HOOKEDGE implant) rather than a fixable vulnerability. Worth reviewing memory-injection and reflective-loading detection gaps in EDR coverage if you run defense/aerospace workloads.
  • SOC/IR — Plan: APT28’s new HOOKEDGE backdoor and reflective loader represent TTPs worth building detection coverage for this quarter; the summary lacks published IOCs, so prioritize creating or tuning rules for reflective DLL injection patterns and anomalous process hollowing in Sigma/KQL.
  • Leader — Learn: Active APT28 campaign against NATO defense-industrial base is useful context for the risk register; if your org supplies or partners with naval/defense primes, elevate to Act and request supply-chain exposure assessment from those partners.
Act archived APT28 HOOKEDGE Backdoor Hits European Gov/Diplomatic Targets
2026-08-28 · The Hacker News · source ↗ #apt28#backdoor#espionage
  • Engineer — Skip
  • SOC/IR — Act: APT28-linked HOOKEDGE is a new Windows batch-script backdoor actively used against government and diplomatic targets in Europe; hunt for suspicious batch-script persistence mechanisms and lateral movement patterns consistent with APT28 TTPs (ATT&CK: T1059.003) in Windows endpoint telemetry since September 2025.
  • Leader — Learn: APT28 has deployed a novel backdoor against European government and diplomatic organizations — relevant for sector-risk awareness and to brief leadership if your organization has European government ties or similar exposure profile.