APT28 (Swallowtail) breaches NATO-country shipbuilder, aircraft engine maker and law enforcement agency using Hookedge backdoor
Symantec reports that APT28 (also tracked as Swallowtail, Fancy Bear and Forest Blizzard), a group linked to Russia's GRU, compromised two defense firms and a law enforcement agency in NATO countries in recent months. The victims were a naval shipbuilder, a manufacturer of military aircraft engines and the agency. At the shipbuilder, operators returned repeatedly to a compromised host over about a week and stole credential material in hands-on-keyboard activity, which Symantec's Dick O'Brien said confirms the organization was a deliberate target. The motive is uncertain, but O'Brien suggested the activity may be part of collection against nations aiding Ukraine.
Technical Details
- The actors used the Hookedge backdoor, first identified in August by Recorded Future's Insikt Group. Insikt saw the same group use it since September of last year against defense and diplomatic targets in Romania, Spain and Turkey.
- Symantec also observed a previously undocumented loader, ld.exe. It decrypts its payload in memory and needs a key supplied only at runtime on the command line. Symantec did not recover the payload, so its function is unknown.
- The attackers moved their most sensitive follow-up activity onto a dedicated server. Recorded Future had expected them to keep hopping between free services.
- The article does not state the initial access vector.
Remediation
The article gives no specific remediation guidance. Defenders in defense, aerospace and law enforcement should hunt for Hookedge and the ld.exe loader and review credential theft activity on compromised hosts.
Linha do tempo
-
APT28 (Swallowtail) breaches NATO-country shipbuilder, aircraft engine maker and law enforcement agency using Hookedge backdoor
ler a análise desta fonte ocultar
Symantec reports that APT28 (also tracked as Swallowtail, Fancy Bear and Forest Blizzard), a group linked to Russia's GRU, compromised two defense firms and a law enforcement agency in NATO countries in recent months. The victims were a naval shipbuilder, a manufacturer of military aircraft engines and the agency. At the shipbuilder, operators returned repeatedly to a compromised host over about a week and stole credential material in hands-on-keyboard activity, which Symantec's Dick O'Brien said confirms the organization was a deliberate target. The motive is uncertain, but O'Brien suggested the activity may be part of collection against nations aiding Ukraine.
Technical Details
- The actors used the Hookedge backdoor, first identified in August by Recorded Future's Insikt Group. Insikt saw the same group use it since September of last year against defense and diplomatic targets in Romania, Spain and Turkey.
- Symantec also observed a previously undocumented loader, ld.exe. It decrypts its payload in memory and needs a key supplied only at runtime on the command line. Symantec did not recover the payload, so its function is unknown.
- The attackers moved their most sensitive follow-up activity onto a dedicated server. Recorded Future had expected them to keep hopping between free services.
- The article does not state the initial access vector.
Remediation
The article gives no specific remediation guidance. Defenders in defense, aerospace and law enforcement should hunt for Hookedge and the ld.exe loader and review credential theft activity on compromised hosts.