Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

thehackernews.com Oct 20, 2026

Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

Curated by Shubham · TechCapsules · Oct 20, 2026

AI-summarised brief · reviewed before publication

A Russia‑linked state‑sponsored group identified as APT28 (also known as BlueDelta, Fancy Bear and Forest Blizzard) has been linked to cyber‑espionage attacks against two NATO member states. The Symantec Threat Hunter Team, tracking the activity under the name Swallowtail, reported the use of a backdoor called HOOKEDGE and a previously undocumented reflective loader named ld.exe. Victims included a law‑enforcement agency, a naval shipbuilder and a military‑aircraft‑engine manufacturer. In the shipbuilder breach, attackers returned to the compromised host for a week, stole credentials via two distinct methods, opened a persistent SSH tunnel and deployed the new loader, which decrypts and runs an encrypted payload in memory using a runtime key. The campaign shifted from webhook‑based command‑and‑control to a dedicated IP address for tasking and exfiltration. The most recent indicator was a Visual Basic Script launcher observed on 24 September 2026; the extent of data exfiltration remains unknown.

💡 Why It Matters

· The operation demonstrates APT28’s evolving toolset and persistence tactics, raising the risk profile for critical defense suppliers within NATO.

Capsules Defense

Read full article on thehackernews.com

Arqit Invests in Sirius to Develop Quantum-Safe Defence Communications

Arqit Quantum Inc. has invested strategically in Sirius Computer to accelerate the development of Crux, a software‑based quantum‑safe communications platform. The partnership merges Sirius’s secure networking hardware with Arqit’s Sovereign Key Platform and NetworkSecure adaptors, enabling secure data exchange across mobile devices, cloud, and autonomous systems. The investment will fund product development, integration, and joint go‑to‑market efforts targeting NATO members, the UK Ministry of Defence, and the US Department of Defense. Both companies aim to expand secure networking solutions without replacing existing infrastructure.

💡 The collaboration promises a scalable, lightweight quantum‑safe solution that can be deployed on commercial devices, reducing the logistical burden on defence forces while ensuring long‑term data protection.

therobotreport.com · Oct 20

Gecko Robotics secures $300M contract with the U.S. Navy

Gecko Robotics announced that the U.S. Navy and the General Services Administration have raised the ceiling on its contract to $300 million, quadrupling the original $71 million IDIQ award. The expansion funds rapid deployment of Gecko’s Komodo robotic system and associated AI‑driven inspection tools across the fleet. Komodo can scan thick, non‑skid deck coatings without stripping, producing full‑deck heatmaps of corrosion and material thickness, which enables repair teams to plan work before dry‑docking. Gecko claims the technology can identify structural issues up to 50 times faster than traditional methods, cutting inspection times from months to days and saving up to $8 million per ship in repair costs. The contract supports the Navy’s goal of 80 percent fleet readiness by reducing maintenance downtime.

💡 Faster, AI‑powered inspections give the Navy a tangible edge in keeping warships operational, directly translating to stronger deterrence and response capabilities.

space.com · Oct 16

SpaceX launches classified mission for the US Space Force (video)

SpaceX lifted off a classified U.S. Space Force payload from Vandenberg Space Force Base on Oct. 15 at 8:01 p.m. EDT aboard a Falcon 9. The rocket’s first stage, booster 1081, touched down on the drone ship “Of Course I Still Love You” about 8.5 minutes after liftoff, marking its 28th flight and 16th successful recovery. The mission, designated USSF‑481, carried undisclosed payloads to an unknown orbit, and SpaceX provided no further details during the webcast. Booster 1081’s prior record includes crew, cargo, and 16 Starlink deployments among other national‑security missions. USSF‑481 was the 114th Falcon 9 launch of 2026, a year in which more than 70 percent of SpaceX’s flights have supported the Starlink constellation. The sky allowed spectators to view the launch live.

💡 It demonstrates SpaceX’s dual role in commercial broadband expansion and secretive defense operations, underscoring the company’s strategic importance to U.S. national security.

spacenews.com · Oct 16

Oct. 29: Applying AI to the GEOINT Mission

On October 29, SpaceNews and Vantor will host a virtual forum examining how artificial intelligence is reshaping geospatial intelligence (GEOINT) across defense, intelligence and commercial sectors. As satellite‑derived Earth observation data volumes surge, AI tools such as automated target recognition, change detection, multimodal data fusion and large‑language models are becoming essential for rapid pattern identification and anomaly spotting. Panelists will discuss the operational benefits of AI, the remaining need for human analysts, and the hurdles of validating machine‑generated outputs to preserve analyst trust. Vantor will showcase its AI‑ready digital twin platform, which integrates imagery from its satellite constellation with real‑time sensor feeds to automate the full intelligence cycle—from tasking to analysis—at near‑real‑time speeds. The event will be streamed via Zoom, with a recording posted afterward.

💡 AI’s ability to process massive GEOINT streams in real time gives decision‑makers a near‑instantaneous view of global activity, turning raw data into actionable insight faster than ever before.

thehackernews.com · Oct 15

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government…

Silent Lynx, a Kazakhstan‑based threat actor, has conducted a sustained campaign against CIS governments from June 2025 to August 2026. The attacks use four distinct infection chains—macro‑enabled documents, PS2EXE downloaders, GitHub‑hosted PowerShell, and WinRAR archives exploiting CVE‑2025‑8088—to deploy custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Cisco Talos and Recorded Future track the effort as UAT‑6275/TAG‑193, targeting nine CIS countries, including Russia, Belarus, and Central Asian states. The campaign’s breadth and evolving delivery methods underscore its persistent threat to regional governance and critical infrastructure.

💡 The use of a newly weaponized CVE in a high‑profile supply‑chain tool signals a shift toward more sophisticated, low‑visibility intrusion tactics. This escalation heightens the risk to government and energy sectors that rely on legacy software, demanding immediate patching and advanced monitoring.

space.com · Oct 14

Four years ago, NASA punched an asteroid. Europe’s Hera probe arrives this…

NASA’s DART spacecraft struck the small asteroid Dimorphos in September 2022, shortening its orbit around the larger Didymos by about 33 minutes and proving a planetary‑defense technique. Two years later, the European Space Agency’s Hera probe, launched in October 2024, has arrived at the Didymos system to conduct detailed inspections. Hera will map the impact site, assess crater size, and search for debris, while deploying two small probes—Milani and Juventas—to analyze surface composition and internal structure. The mission will clarify the collision’s effects and refine future deflection strategies.

💡 By providing the first close‑up, high‑resolution study of an asteroid that has been deliberately struck, Hera will validate and improve the methods used to alter potentially hazardous objects, strengthening Earth’s planetary‑defense capabilities.