# GRU Targets NATO Defense Contractors

Symantec reported that the Russia-linked GRU group APT28 conducted an espionage campaign against two defense firms in NATO countries—a naval shipbuilder and a military aircraft-engine manufacturer—as well as a law enforcement agency. No procurement action or contract award was announced. For government buyers and contractors, the reported targeting highlights supply-chain and credential-compromise risks across organizations supporting defense and law-enforcement missions.

- The affected sectors include naval shipbuilding, military aircraft engines, and law enforcement; the signal does not identify the organizations or any associated contracts.
- Contractors supporting these missions should review monitoring and incident-response controls for risks involving supplier access and compromised credentials.
- Security providers serving defense and law-enforcement contractors may find demand for services addressing espionage threats and supply-chain exposure.

**Jurisdictions:** international
**Industries:** Defense & Military, Public Safety
**Topics:** Cybersecurity
**Published:** October 20, 2026

### Government Entities
- North Atlantic Treaty Organization (NATO)
- Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU)

### Key Quotes
> What surprised us was that the attackers then moved their most sensitive follow-up activity onto a dedicated server, when Recorded Future had expected them to keep hopping between free services.
> — Dick O’Brien, Principal Intelligence Analyst, Symantec Threat Hunter Team

### Sources
- [Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign | CyberScoop](https://cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms) - CyberScoop