APT28/HOOKEDGE: Credential Capture, Reverse SSH Tunneling, and a Memory Loader at a Naval Shipbuilder

1. Basic Information

• Article Title: Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries
• Publisher: Symantec Threat Hunter Team
• Publication Date: 2026-10-20
• Original Article: Symantec Threat Hunter Team
• Related Source: The Record: Defense contractors in two NATO allies hacked in recent Russia-linked campaign
• Related Malware and Threat Groups: HOOKEDGE, ld.exe reflective loader, APT28, Swallowtail, Fancy Bear, Forest Blizzard
• Related CVEs: None
• Related Products: Microsoft Word, Microsoft Edge, PowerShell, SSH
• Severity: High
• Basis for Severity: HOOKEDGE activity was confirmed across three organizations in two NATO member countries, including law enforcement, a shipbuilding firm, and a military aircraft engine manufacturer. Note that the detailed timeline from July 24 to September 24, along with credential acquisition, the SSH tunnel, and loader execution, represents the shipbuilding case, and does not imply that all three activities were confirmed across all three organizations.
• Reason for Update: Updated to align the primary source, prerequisites, observation scope, confidence statements, and ATT&CK mappings with primary sources and official specifications. This editorial update is distinct from the original source's publication or update timestamp.

2. Executive Summary

Symantec confirmed activity involving HOOKEDGE by the Russian threat group APT28 (Swallowtail) across three organizations: a shipbuilding firm, a military aircraft engine manufacturer, and a law enforcement agency in two NATO member countries. In the detailed shipbuilding case, the activity included acquiring NTLM challenge-response authentication responses, establishing a reverse SSH tunnel, and launching an in-memory loader (ld.exe). However, the final payload (Events.dat) itself was not recovered.

3. Attack Flow

The following timeline is from a single shipbuilding enterprise case for which details were published, and does not mean that the exact same attack chain was confirmed in the other two organizations.

Timeline Confirmed at the Shipbuilding Enterprise

1. Initial Deployment via Macro-Enabled Word Document (July 24): A macro-enabled Word document opened from an Outlook attachment cache dropped VBS scripts, HTML/XHTML files, and batch files. Early-stage HOOKEDGE used Microsoft Edge launched off-screen to fetch tasks from webhook.site, with batch files returning execution results.
2. Second-Stage Task Retrieval (July 27): In the second stage, curl and VBS were used to retrieve tasks from 185.82.218[.]119:443 and send execution results back to the same server (this does not imply Edge handled communication in all second-stage activities).
3. Reverse SSH Tunnel and NTLM Authentication Response Acquisition: The attacker placed an attacker-controlled SSH private key on the host to initiate an outbound SSH connection to the attacker's server (port 80) and requested a reverse dynamic port forwarding session. Separately, authentication was triggered against a PowerShell loopback listener to capture an NTLM challenge-response. (The placed SSH key was distinct from any keys stolen from the victim.)
4. SSH Process Termination and Loader Execution (July 28 and 31): ssh.exe was terminated on July 28. On July 31, execution commands referencing ld.exe, the input file Events.dat, and a decryption key were recorded. While ld.exe has the capability to decrypt payloads in memory and invoke ExecuteLoader, Events.dat was not recovered, leaving the contents and behavior of the final payload unconfirmed.
5. Persistent Artifacts from August to September: The same loader and VBS files were still present on the host in late August, and VBS activity was observed again on September 24. However, it was not confirmed whether human interactive operation occurred throughout this period or if the same SSH tunnel remained active for two months.

Date / Phase (Shipbuilding Case)	Observed Processes, Communications, and Files	Technical Characteristics and Interpretive Caveats
July 24 (Initial Incursion & Stage 1)	Outlook attachment macro Word → VBS / HTML / batch, off-screen Edge → webhook.site	Abused legitimate browser (Edge) and webhook service to fetch initial tasks and submit responses
July 27 (Stage 2, Tunnel, Auth Capture)	curl / VBS → 185.82.218[.]119:443, ssh.exe → 185.82.218[.]119:80, PowerShell loopback listener	SSH key was brought by the attacker. Captured data was an NTLM challenge-response; distinct from plain-text passwords or direct NT hash acquisition
July 31 – Sep 24 (Loader & Persistence)	ld.exe + Events.dat + runtime decryption key. Loader and VBS present in late August; VBS activity observed Sep 24	Confirmed in-memory decryption and execution features of ld.exe. Events.dat (final payload) was not recovered. File presence does not equal continuous human operation

4. Attacker Positioning and Execution Locations

• External APT operators capable of delivering lure documents to users in the defense industry and law enforcement agencies
• Operators executing HOOKEDGE on compromised Windows hosts
• Post-compromise actors attempting to access internal networks via reverse SSH tunnels

5. Victim and Administrator Perspectives

Victims

• Word documents appear as normal business-related files (lures), and backdoors may persist in the background even after fake error messages are displayed.
• Access blends continuously with normal Microsoft Edge and SSH traffic.

Administrators and SOCs

• Script execution originating from Office processes, scheduled task creation, off-screen Edge execution, unexpected outbound SSH connections, and PowerShell loopback listeners can be observed.
• Payloads decrypted and unpacked exclusively in memory by ld.exe are difficult to detect via disk-only file scanning.

6. Success and Failure Conditions

Success Conditions

• In the shipbuilding enterprise's initial path, a macro-enabled Word document must be opened and macros executed (this does not imply the exact same initial path and actions were confirmed across all three organizations).
• For the corresponding stages, the endpoint must be able to make outbound connections: Edge to webhook.site in the first stage, second-stage tooling to 185.82.218[.]119:443, and the SSH client to the attacker's server on port 80.
• The endpoint must permit script and PowerShell execution, scheduled tasks, placement of the SSH key, and execution of the SSH client using that key.

Failure Conditions and Mitigations

• Block macros in internet-origin Office files marked with Mark-of-the-Web and restrict child process generation from Office applications.
• Allowlist outbound SSH traffic and external webhook services from client workstations.
• Enable credential protection features (such as NTLM restrictions) and EDR memory telemetry monitoring.

7. Outcomes Upon Success

• Continuous access to endpoints within defense industries and law enforcement agencies, alongside the acquisition of credential material.
• Establishment of encrypted reverse SSH channels leading into internal networks.
• Potential theft of defense-related sensitive information, though successful theft of sensitive information remains unconfirmed.

8. Observable Logs

Inference: The following items are candidates for internal investigation. Log availability depends on product features, permissions, configurations, and retention periods. Do not attribute incidents or confirm compromises solely based on isolated suspicious operations or missing logs.

Email

• Check for macro-enabled Word attachments, defense- or meeting-related lure subjects, and anomalous sender addresses or domains.

Proxy / SWG / DNS

• Correlate initial-stage traffic from Edge to webhook.site with second-stage traffic from tools like curl to 185.82.218[.]119:443. Also independently verify SSH connections to 185.82.218[.]119:80, ensuring port 80 traffic is not automatically assumed to be HTTP.

Endpoint / EDR

• Check for Office application child processes, batch/VBS scripts, scheduled tasks, off-screen Edge instances, ld.exe, and PowerShell loopback listeners.

Identity / IdP

• Inference: Investigate offline cracking attempts, unauthorized authentication, unknown logins, and suspicious SSH key usage following NTLM challenge-response capture. Note that NTLM responses should not be equated directly with NT hashes, and successful simple replays or Pass-the-Hash attacks should not be presumed.

SaaS / Cloud

• If the use of external webhook services is permitted in business operations, verify the identity of the user (business owner) and the legitimate purpose.

Network

• Check for persistent outbound SSH tunnels from workstations, TLS communication with C2 servers, and suspicious Edge beacon traffic.

9. Attack Success Assessment

• Subsequent Compromise Confirmed
• Basis: Publicly, Symantec observed HOOKEDGE activity across three organizations. Specific details regarding credential material acquisition, reverse SSH tunnels, and reflective loader execution were confirmed in the shipbuilding enterprise case. However, the contents of the final payload and the success of sensitive data exfiltration remain unconfirmed.
• Scope: Successful exfiltration of sensitive information and the full duration of compromise across all three organizations have not been confirmed.

10. Investigation Playbook

• Trigger: Check for traces of Office child processes, batch/script execution, scheduled tasks, off-screen Edge, ld.exe, and PowerShell loopback listeners.
• Initial Verification: Normalize target assets, accounts, and event timestamps to UTC/JST, and preserve related logs.
• Endpoint / Server Investigation: Investigate the chain of Office → script → scheduled task → off-screen Edge, unexpected outbound SSH connections, and PowerShell listeners.
• Authentication / Cloud Investigation: Inference: Investigate cracking attempts, unauthorized authentication, unknown logins, and SSH key usage following NTLM challenge-response capture (do not equate NTLM responses with NT hashes, and do not presume successful simple replays or Pass-the-Hash).
• Subsequent Operations: Track internal reconnaissance via reverse SSH tunnels or suspicious memory and network behaviors following ld.exe execution.
• Containment: Block internet-sourced macros and restrict Office child processes, isolate suspicious outbound SSH connections and affected hosts, and reset credentials for impacted accounts.
• Assessment Categories: Clearly separate contact, execution, authentication success, information acquisition, and subsequent compromise; do not assume unconfirmed successes.

11. Defense and Detection Ideas

• Single Events: Detect Office child processes, batch/script execution, scheduled task registration, off-screen Edge execution, ld.exe execution, and PowerShell loopback listeners.
• Time-Series Correlation: Inference: Drawing on the shipbuilding timeline, correlate macro-enabled Word execution → initial Edge/webhook traffic → second-stage curl/VBS traffic → reverse SSH tunnel establishment/NTLM loopback acquisition → loader (ld.exe) execution by timestamp and host (do not assume a common chain or final payload execution across all three organizations initially).
• Threat Hunting: Hunt for persistent outbound SSH tunnels from workstations (including non-standard ports like port 80), C2 TLS traffic, and suspicious Edge beacon traffic.
• Log Limitations: Specific NATO member country names, organization names, and the contents of the unrecovered Events.dat cannot be determined from public information alone.
• Priority Mitigations: Block internet-sourced macros and restrict Office child processes. Allowlist outbound SSH and webhook services from workstations, and enable credential protection along with EDR memory telemetry.

12. Facts, Inference, and Hypothesis

Facts

• The targets consist of three organizations in two NATO member countries: a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency.
• At the shipbuilding enterprise, HOOKEDGE was deployed from a macro-enabled Word document, and operators repeatedly accessed the same host over approximately one week.
• During the initial stage at the shipbuilding enterprise, off-screen Edge and webhook.site were used for task retrieval and result submission, while curl and 185.82.218[.]119:443 were used in the second stage (task communication over HTTPS port 443 is distinct from SSH tunnels to port 80).
• Techniques observed included placing an attacker-owned SSH private key to establish a background reverse tunnel, and acquiring an NTLM handshake (challenge-response) via a separate loopback listener (the former is not treated as stealing the victim's SSH key, and the latter is not treated as acquiring plaintext passwords or raw NT hashes).
• ld.exe features runtime decryption of input files using a key and invokes ExecuteLoader in memory. While the execution command has been confirmed, Events.dat was not recovered, and the functionality and results of the final payload remain unconfirmed.
• Symantec attributed this activity to APT28 (Swallowtail), but specific victim countries, organization names, and confirmation of successful sensitive data exfiltration have not been publicly disclosed.

Inference

• By combining legitimate Microsoft Edge, general-purpose webhooks, and standard SSH, the attackers attempt to evade detection by relying on process chains and blending into normal business traffic rather than depending on static IOCs.
• Because defense suppliers hold design information and trusted access paths to prime contractors, they can serve as an entry point for intelligence collection via the supply chain.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Open Questions and Additional Investigations."

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1566.001	Phishing: Spearphishing Attachment	high	A Word document opened from the Outlook attachment cache was confirmed at the shipbuilding firm. Definition
T1204.002	User Execution: Malicious File	high	AutoOpen and initial file placement after opening the document were recorded. Definition
T1053.005	Scheduled Task/Job: Scheduled Task	medium	A scheduled task for the second-stage installer was reported. The reason for subsequent VBS activity is undetermined. Definition
T1187	Forced Authentication	high	Authentication was triggered toward a loopback listener to obtain an NTLM handshake. Definition
T1572	Protocol Tunneling	high	An SSH connection was established from the victim host to the attacker's port 80 to request reverse dynamic forwarding. Definition
T1620	Reflective Code Loading	medium	In-memory decryption and ExecuteLoader invocation features of ld.exe along with execution commands were confirmed; final payload unrecovered. Definition

14. Open Questions and Additional Investigations

• Specific NATO member country names and target organization names
• All variations of macro lure documents exploited and the initial access vectors at the remaining two organizations
• The contents of the final payload (Events.dat) that ld.exe attempted to decrypt and execute
• The actual scope of defense- and law enforcement-related sensitive data exfiltrated
• Details on the duration of persistent intrusion across each of the three organizations

15. Impact on SOCs and Organizations

Suppliers in the defense, heavy industry, and transportation equipment sectors should monitor comprehensively for internet-sourced Office macros, off-screen Edge execution, outbound SSH tunnels originating from workstations (including non-standard ports), and NTLM forced authentication. Rather than relying solely on isolated IOC matching, tracking must be conducted across the entire timeline from Office document execution to network tunneling and memory loader execution.

16. Summary by Target Audience

• For SOCs: Check for persistent outbound SSH tunnels from workstations, C2 TLS traffic, and suspicious Edge beacon traffic, and investigate Office child processes, batch/scripts, scheduled tasks, off-screen Edge, ld.exe, and PowerShell loopback listeners.
• For Administrators: Block internet-sourced macros, and restrict child process generation from Office applications along with unnecessary outbound SSH traffic from workstations.
• For Users: If you encounter suspicious notifications, errors, or authentication requests, do not attempt to resolve them independently; contact your administrator immediately.