TL;DR
- what: APT28, tracked by Symantec as Swallowtail, used new HOOKEDGE backdoor variants and an undocumented reflective loader against defense and law enforcement targets in two NATO countries.
- impact: At a naval shipbuilder the attackers held hands-on-keyboard access for a week, captured NTLM credentials, planted an SSH key and opened a persistent tunnel from their infrastructure into the internal network.
- fix: No single patch closes this campaign; the HOOKEDGE chain starts with macro-enabled Word documents, and APT28's related operations exploit CVE-2026-21509 in Microsoft Office and CVE-2026-8496 in SOGo webmail, both of which have vendor fixes.
- who: Defense manufacturers, shipbuilders, aerospace suppliers, law enforcement and government bodies in NATO countries, plus anyone in their supply chains.
Russia's GRU-linked APT28 (also tracked as Fancy Bear, BlueDelta and Forest Blizzard) has breached a naval shipbuilder in a NATO member state and stayed active inside its network for at least two months. The Symantec Threat Hunter Team, which tracks the activity as Swallowtail, says the same campaign hit a military aircraft engine manufacturer and a law enforcement agency across two NATO countries. These are organizations whose design data, contracts and investigative records are worth a lot to a foreign intelligence service.
What sets this report apart is what happened after the attackers got in. Earlier public reporting on this campaign stopped at delivery. Symantec documents hands-on-keyboard activity over a full week, two independent credential theft techniques, a persistent SSH tunnel into the internal network and a reflective loader nobody had documented before.
HOOKEDGE: A Batch Script Backdoor Hiding Behind a Browser
Recorded Future's Insikt Group first described HOOKEDGE in late August 2026, linking it to APT28 attacks on government and diplomatic targets in Romania, Spain and Türkiye between September 2025 and early April 2026. HOOKEDGE shares a lot of code and tradecraft with HEADLACE, a modular Windows implant APT28 has used against diplomats since April 2023.
The backdoor itself is minimal. It is a Windows batch script delivered through macro-enabled Microsoft Word documents attached to spear-phishing emails. It takes attacker commands and sends the output back. The original variants ran all command and control through a webhook[.]site URL, a legitimate request-capture service, and pulled tasks with a hidden, off-screen Microsoft Edge instance instead of a conventional downloader. To network monitoring, that traffic looks like a browser talking to a public web service.
Infrastructure shift — In the late July 2026 shipbuilder intrusion, the new HOOKEDGE variants dropped webhook[.]site and used a dedicated IP address, 185.82.218[.]119 on port 443, for both tasking and exfiltration. Detections built only around webhook[.]site traffic will miss these variants.
Inside the Shipbuilder: A Week of Hands-On Operations
Symantec says operators came back to one compromised host again and again over the course of a week. That points to a human operator working toward a goal, not an automated implant running a script. The post-compromise chain had four parts.
- SSH key planting and reverse tunnel: the attackers pushed an SSH private key onto the host and immediately used it to connect back to their own server, asking for a persistent, backgrounded tunnel. That gave them a route from their infrastructure straight into the internal network, independent of the HOOKEDGE channel.
- NTLM capture over loopback: a short, self-contained PowerShell script started a listener on the host's own loopback address and forced the machine to authenticate to it, capturing the resulting NTLM handshake. Captured NTLM material can be cracked offline or relayed to move laterally.
- Loader delivery over SSH: using curl through the SSH session, the attackers dropped ld.exe, a reflective loader that decrypts and runs an encrypted payload in memory using a key supplied at runtime.
- Continued presence: the latest activity Symantec saw was on September 24, 2026, when a Visual Basic Script launcher tied to HOOKEDGE showed up on the shipbuilder's network, roughly two months after the July intrusion.
Because the decryption key arrives at runtime, the payload sitting on disk is useless for analysis without it. That is why Symantec could not identify the next-stage component ld.exe was built to run. It is also unclear whether any data left the network.
⚠️ Why the tunnel matters — A persistent reverse SSH tunnel turns one infected workstation into a standing entry point. Even if the HOOKEDGE script is found and removed, the tunnel and the stolen credentials can keep the attackers inside. Cleanup that only targets the initial implant will leave them with access.
The Broader APT28 Picture: Ukraine and Webmail
The shipbuilder intrusion fits a wider pattern. In a report published late last month, CERT-UA said APT28 has been exploiting CVE-2026-21509, a security feature bypass in Microsoft Office, to deliver the COVENANT malware. It has also exploited CVE-2026-8496, a zero-click flaw in the SOGo webmail client, to steal mailbox credentials and data. CERT-UA added that the group is still using cross-site scripting bugs in Roundcube webmail, describing the older techniques as tried and tested and still effective.
CERT-UA also reported that Russian operators are increasingly going after smartphones belonging to Ukrainian military personnel and officials. That includes the DarkSword iOS exploit kit, served through watering-hole attacks on compromised Ukrainian news and government sites. Google Threat Intelligence Group tied DarkSword and the Coruna kit to the Russian espionage actor UNC6353 in March 2026. On Android, the clusters UAC-0244 and UAC-0263 use decoy apps to deliver CAMELSPY, which collects location, contacts, call logs, SIM details and photos, and BTMOB RAT, which gives full device control.
Assessment: Defense Supply Chains Are the Target
The targets picked here (a naval shipbuilder, a military engine manufacturer and a law enforcement agency) line up with collection priorities around NATO naval and air capability. These are often mid-sized industrial companies with corporate IT built for manufacturing, not for resisting a state intelligence service that is prepared to spend a week on one host.
The tradecraft is cheap and hard to spot. The initial implant is a batch script. Command and control first rode a legitimate web service and then a single IP on port 443. Credential theft used built-in PowerShell and native NTLM behavior. Persistence came from standard SSH. None of it needs a zero-day, and every step blends into normal administrative traffic. The only custom component, ld.exe, keeps its payload encrypted until the operator supplies the key.
On mitigation, the vendor fixes that apply are the Microsoft patch for CVE-2026-21509 and the SOGo fix for CVE-2026-8496, both exploited in APT28's parallel operations. The HOOKEDGE chain in this report does not rely on a software vulnerability. It relies on a user enabling macros in a Word document, so it falls under Office macro policy and email controls rather than patching. Symantec's report is the main source for indicators, including the 185.82.218[.]119 infrastructure. Organizations in the defense industrial base should assume this activity is still going on, since the most recent sighting was less than a month ago.
Originally published on RedEye Threat Intelligence.
Top comments (0)