APT28 (Swallowtail) breaches NATO naval shipbuilder, aircraft engine maker and law enforcement agency with HOOKEDGE backdoor and new ld.exe loader

Linha do tempo

1. gbhackers.com ↗ · pub. 21/10/2026 06:49 · coletado 21/10 08:00

   APT28 (Swallowtail) uses Hookedge backdoor and SSH tunnel in months-long intrusion at NATO shipbuilder

   ler a análise desta fonte ocultar

   Swallowtail (also tracked as APT28, Fancy Bear and Forest Blizzard), a Russian espionage group linked by the U.S. government to the GRU, targeted organizations in two NATO member states. Victims included a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. Symantec's Threat Hunter Team reported that the shipbuilder was compromised for at least two months, with the operators stealing credential material, setting up a persistent SSH tunnel and deploying a previously undocumented loader. The target profile points to intelligence collection on national security and defense.

   Technical Details

   • Initial access on July 24, 2026: a recipient opened a malicious Word attachment from Outlook's attachment cache. An obfuscated macro dropped files that launched Hookedge, a lightweight backdoor.
   • Hookedge used a hidden, off-screen Microsoft Edge instance to fetch tasks from webhook.site and return command output. The first task surveyed the host and tested access to cloud services and external destinations.
   • Three days later, a second-stage component fetched commands from attacker-controlled infrastructure. Seven tasks arrived in about 30 seconds, consistent with interactive operator activity.
   • Credential theft used two methods. First, the operators placed an SSH private key on the host, adjusted its permissions and used Windows OpenSSH to create a backgrounded remote port forward into the internal network. Second, a short PowerShell script set up a local listener and induced the host to authenticate to it, capturing NTLM challenge-response material that could enable offline cracking or relay.
   • DNS lookups and pings to internal hostnames indicate internal network mapping.
   • On July 31, the attackers ran ld.exe with an encrypted file (Events.dat) and a runtime-supplied key. It decrypts its payload in memory and calls an exported function named ExecuteLoader. The payload was not recovered, so its purpose is unknown.
   • The loader and Hookedge launcher were found again weeks later, and the launcher was observed on September 24. It is unclear whether this was continued tasking or dormant persistence.
   • Recorded Future previously documented Hookedge activity attributed to BlueDelta, an overlapping APT28 name, against government and diplomatic targets.

   Remediation

   • Finding the initial backdoor is not enough for containment. Hunt for suspicious Office macros, unusual browser launches, outbound webhook traffic, unexpected OpenSSH use and local NTLM listener activity.
   • Review SSH keys and privileged credentials on affected systems, and revoke or rotate any exposed credentials.
   • Examine DNS and network logs for access to internal hosts.
   • Symantec's report includes file hashes, network indicators and detection guidance.
2. cyberscoop.com ↗ · pub. 20/10/2026 14:55 · coletado 20/10 16:00

   APT28 (Swallowtail) breaches NATO-country shipbuilder, aircraft engine maker and law enforcement agency using Hookedge backdoor

   ler a análise desta fonte ocultar

   Symantec reports that APT28 (also tracked as Swallowtail, Fancy Bear and Forest Blizzard), a group linked to Russia's GRU, compromised two defense firms and a law enforcement agency in NATO countries in recent months. The victims were a naval shipbuilder, a manufacturer of military aircraft engines and the agency. At the shipbuilder, operators returned repeatedly to a compromised host over about a week and stole credential material in hands-on-keyboard activity, which Symantec's Dick O'Brien said confirms the organization was a deliberate target. The motive is uncertain, but O'Brien suggested the activity may be part of collection against nations aiding Ukraine.

   Technical Details

   • The actors used the Hookedge backdoor, first identified in August by Recorded Future's Insikt Group. Insikt saw the same group use it since September of last year against defense and diplomatic targets in Romania, Spain and Turkey.
   • Symantec also observed a previously undocumented loader, ld.exe. It decrypts its payload in memory and needs a key supplied only at runtime on the command line. Symantec did not recover the payload, so its function is unknown.
   • The attackers moved their most sensitive follow-up activity onto a dedicated server. Recorded Future had expected them to keep hopping between free services.
   • The article does not state the initial access vector.

   Remediation

   The article gives no specific remediation guidance. Defenders in defense, aerospace and law enforcement should hunt for Hookedge and the ld.exe loader and review credential theft activity on compromised hosts.

3. thehackernews.com ↗ · pub. 20/10/2026 08:06 · coletado 20/10 10:00 primeiro registro

   APT28 (Swallowtail) breaches NATO naval shipbuilder using HOOKEDGE backdoor and new reflective loader

   ler a análise desta fonte ocultar

   Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operators returned repeatedly to a compromised host over about a week in apparent hands-on-keyboard activity. They stole credentials with two techniques, opened a persistent SSH tunnel into the internal network and deployed a previously undocumented reflective loader. The latest activity was seen on September 24, 2026, and it is unclear whether data was stolen. The article also summarizes CERT-UA reporting on Russian targeting of Ukrainian smartphones and on APT28 exploitation of Office, SOGo and Roundcube flaws, plus new LegionRelay C2 servers identified by Team Cymru.

   Technical Details

   • HOOKEDGE is a barebones Windows batch script backdoor delivered through spear-phishing with macro-enabled Word documents. It shares code and tradecraft with HEADLACE. Earlier variants used a webhook[.]site URL for tasking and output, fetched via a hidden, off-screen Microsoft Edge instance. Recorded Future Insikt Group first documented it in August 2026, in a campaign against Romania, Spain and Türkiye between September 2025 and April 2026.
   • New HOOKEDGE variants in the shipbuilder attack drop webhook[.]site and use the dedicated IP 185.82.218[.]119:443 for tasking and exfiltration.
   • Credential theft used two techniques. First, an SSH private key was pushed to the host and used to open a persistent, backgrounded SSH tunnel to attacker infrastructure. Second, a short PowerShell script started a listener on the host's loopback address and forced the machine to authenticate to it, capturing the NTLM handshake.
   • A new reflective loader (ld.exe), dropped via a curl command over SSH, decrypts and runs an encrypted payload in memory using a key supplied at runtime. The payload is unknown. A Visual Basic Script launcher associated with HOOKEDGE was seen on the shipbuilder's network on September 24, 2026.
   • CERT-UA (H1 2026: 3,137 incidents, about 8% more than in H2 2025) reports the DarkSword iOS exploit kit spread through watering-hole attacks on compromised Ukrainian news and government sites. GTIG linked UNC6353 to Coruna and DarkSword in March 2026. On Android, UAC-0244 distributes CAMELSPY and UAC-0263 distributes BTMOB RAT, both via decoy apps.
   • CERT-UA saw APT28 exploiting CVE-2026-21509 (Microsoft Office security feature bypass) to deliver COVENANT, and CVE-2026-8496 (zero-click flaw in SOGo webmail) to steal mailbox credentials and data. APT28 also used Roundcube XSS flaws and macro-laden Excel documents to spread COVENANT.
   • Team Cymru identified five additional C2 servers for LegionRelay, a PowerShell RAT attributed to GREYVIBE that is active against Ukraine since at least August 2025.

   Remediation

   • Block or monitor the HOOKEDGE C2 IP and webhook[.]site traffic, and alert on hidden or headless Microsoft Edge launched from Office or script processes.
   • Disable Office macros from untrusted sources and patch CVE-2026-21509 and CVE-2026-8496.
   • Hunt for unexpected SSH key deployment, outbound SSH tunnels, curl executed over SSH, loopback listeners forcing NTLM authentication, and ld.exe.
   • Restrict NTLM where possible and rotate credentials on hosts showing signs of compromise.