Russian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog post Tuesday.

The infamous group behind hacks of the Democratic National Committee during the 2016 election cycle was behind the attacks that Symantec identified in recent months: Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, notorious for its links to the Russian military agency GRU.

The hackers apparently chose the targets of their attacks carefully, including a naval shipbuilder, a manufacturer of military aircraft engines and the law enforcement agency. In the attack on the shipbuilder, Symantec saw “hands-on-keyboard” activity as the hackers repeatedly returned to a compromised host over the course of a week to steal credentialed material.

“Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine,” Dick O’Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop. “It’s essentially confirmation that the organization is a genuine target for the operators, not an accidental infection. It also confirms that further exploitation beyond the initial infection was at least attempted.”

O’Brien said the campaign reflected broader intelligence collection aimed at European government and defense targets, but its motive wasn’t certain. He speculated that it could have been part of campaigns to target nations aiding Ukraine in its war against Russia.

The hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group. That firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey.

Symantec also observed the hackers deploying a previously undocumented loader.

“What surprised us was that the attackers then moved their most sensitive follow-up activity onto a dedicated server, when Recorded Future had expected them to keep hopping between free services,” O’Brien said. “The loader, ld.exe, hadn’t been publicly documented. It decrypts its payload in memory, and it needs a key supplied only at runtime on the command line. Without both the encrypted file and the key, the payload can’t be recovered. We didn’t recover it, so we don’t know its function.”

This spring, researchers and U.S. government agencies said they quashed a Forest Blizzard espionage campaign. Western governments warned last year about the group targeting companies supporting Ukraine.

The post Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign appeared first on CyberScoop.

An international law enforcement operation carried out against organized crime groups in West Africa resulted in 58 arrests and identified 263 suspects, Interpol announced Tuesday.

The operation, known as Operation Jackal IV, aimed to disrupt money laundering, locate high-value targets, seize assets and support prosecutions tied to various Africa-based criminal groups, including Black Axe. 

Black Axe is a highly structured, hierarchical group that generates billions of dollars in criminal proceeds annually from many small-scale operations spanning dozens of countries. The group’s leaders are Nigerian nationals, according to a Europol release issued earlier this year. In January, European law enforcement arrested dozens of the group’s members for adversary-in-the-middle scams such as business email compromise, money laundering and vehicle trafficking. 

“Operation Jackal IV demonstrates the power of international cooperation,” Tomonobu Kaya, director of Interpol’s Financial Crime and Anti-Corruption Centre, said in a release. “By following illicit financial flows across borders, we are attacking the very lifeblood of organized crime and making it increasingly difficult for criminal networks to profit from their activities.”

The agency said it will continue to work to unravel the full details of each case, but detailed several preliminary discoveries from partner organizations Tuesday.

Romanian authorities broke up a group that ran an investment scam from a call center promising high returns in stocks or cryptocurrencies. Victim payments were routed to electronic wallets controlled by the operators, with police estimating the full value at 143 million euros (approximately $166 million). They arrested 11 people and seized about 330,000 euros ($379,000) in cash and cryptocurrency, six properties and several luxury watches.

In South Africa, where 39 of the 58 arrests occurred, police raided seven sites in Johannesburg tied to a syndicate that targeted retirees in English-speaking countries with romance and investment scams. Investigators seized $2.67 million and blocked 257 bank accounts.

Authorities in Argentina identified 196 people linked to a Crime-as-a-Service network suspected of supplying website domains and laundering support to West African groups, making 17 arrests. 

In Italy, one person was identified in connection with a pan-European laundering network built on shell companies, remittance services and cash withdrawals. A single account moved 845,000 euros ($736,000) through 560 transactions.

Investigators also noted the group’s growing focus on sextortion, with victims as young as 14. Similar to actions taken by The Com, Interpol says offenders are contacting teenagers on social media, coercing them into taking explicit images, then demanding payment to keep the material private.

This is not the first time Interpol has taken measures to disrupt African-based groups. In 2024, a similar Interpol operation led to 300 arrests, $3 million in assets seized and 720 blocked bank accounts.

The post Interpol targets Black Axe’s illicit financial web in latest international sting appeared first on CyberScoop.