APT28 (Swallowtail) breaches NATO naval shipbuilder using HOOKEDGE backdoor and new reflective loader
Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operators returned repeatedly to a compromised host over about a week in apparent hands-on-keyboard activity. They stole credentials with two techniques, opened a persistent SSH tunnel into the internal network and deployed a previously undocumented reflective loader. The latest activity was seen on September 24, 2026, and it is unclear whether data was stolen. The article also summarizes CERT-UA reporting on Russian targeting of Ukrainian smartphones and on APT28 exploitation of Office, SOGo and Roundcube flaws, plus new LegionRelay C2 servers identified by Team Cymru.
Technical Details
- HOOKEDGE is a barebones Windows batch script backdoor delivered through spear-phishing with macro-enabled Word documents. It shares code and tradecraft with HEADLACE. Earlier variants used a webhook[.]site URL for tasking and output, fetched via a hidden, off-screen Microsoft Edge instance. Recorded Future Insikt Group first documented it in August 2026, in a campaign against Romania, Spain and Türkiye between September 2025 and April 2026.
- New HOOKEDGE variants in the shipbuilder attack drop webhook[.]site and use the dedicated IP 185.82.218[.]119:443 for tasking and exfiltration.
- Credential theft used two techniques. First, an SSH private key was pushed to the host and used to open a persistent, backgrounded SSH tunnel to attacker infrastructure. Second, a short PowerShell script started a listener on the host's loopback address and forced the machine to authenticate to it, capturing the NTLM handshake.
- A new reflective loader (ld.exe), dropped via a curl command over SSH, decrypts and runs an encrypted payload in memory using a key supplied at runtime. The payload is unknown. A Visual Basic Script launcher associated with HOOKEDGE was seen on the shipbuilder's network on September 24, 2026.
- CERT-UA (H1 2026: 3,137 incidents, about 8% more than in H2 2025) reports the DarkSword iOS exploit kit spread through watering-hole attacks on compromised Ukrainian news and government sites. GTIG linked UNC6353 to Coruna and DarkSword in March 2026. On Android, UAC-0244 distributes CAMELSPY and UAC-0263 distributes BTMOB RAT, both via decoy apps.
- CERT-UA saw APT28 exploiting CVE-2026-21509 (Microsoft Office security feature bypass) to deliver COVENANT, and CVE-2026-8496 (zero-click flaw in SOGo webmail) to steal mailbox credentials and data. APT28 also used Roundcube XSS flaws and macro-laden Excel documents to spread COVENANT.
- Team Cymru identified five additional C2 servers for LegionRelay, a PowerShell RAT attributed to GREYVIBE that is active against Ukraine since at least August 2025.
Remediation
- Block or monitor the HOOKEDGE C2 IP and webhook[.]site traffic, and alert on hidden or headless Microsoft Edge launched from Office or script processes.
- Disable Office macros from untrusted sources and patch CVE-2026-21509 and CVE-2026-8496.
- Hunt for unexpected SSH key deployment, outbound SSH tunnels, curl executed over SSH, loopback listeners forcing NTLM authentication, and ld.exe.
- Restrict NTLM where possible and rotate credentials on hosts showing signs of compromise.
Linha do tempo
-
APT28 (Swallowtail) breaches NATO naval shipbuilder using HOOKEDGE backdoor and new reflective loader
ler a análise desta fonte ocultar
Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operators returned repeatedly to a compromised host over about a week in apparent hands-on-keyboard activity. They stole credentials with two techniques, opened a persistent SSH tunnel into the internal network and deployed a previously undocumented reflective loader. The latest activity was seen on September 24, 2026, and it is unclear whether data was stolen. The article also summarizes CERT-UA reporting on Russian targeting of Ukrainian smartphones and on APT28 exploitation of Office, SOGo and Roundcube flaws, plus new LegionRelay C2 servers identified by Team Cymru.
Technical Details
- HOOKEDGE is a barebones Windows batch script backdoor delivered through spear-phishing with macro-enabled Word documents. It shares code and tradecraft with HEADLACE. Earlier variants used a webhook[.]site URL for tasking and output, fetched via a hidden, off-screen Microsoft Edge instance. Recorded Future Insikt Group first documented it in August 2026, in a campaign against Romania, Spain and Türkiye between September 2025 and April 2026.
- New HOOKEDGE variants in the shipbuilder attack drop webhook[.]site and use the dedicated IP 185.82.218[.]119:443 for tasking and exfiltration.
- Credential theft used two techniques. First, an SSH private key was pushed to the host and used to open a persistent, backgrounded SSH tunnel to attacker infrastructure. Second, a short PowerShell script started a listener on the host's loopback address and forced the machine to authenticate to it, capturing the NTLM handshake.
- A new reflective loader (ld.exe), dropped via a curl command over SSH, decrypts and runs an encrypted payload in memory using a key supplied at runtime. The payload is unknown. A Visual Basic Script launcher associated with HOOKEDGE was seen on the shipbuilder's network on September 24, 2026.
- CERT-UA (H1 2026: 3,137 incidents, about 8% more than in H2 2025) reports the DarkSword iOS exploit kit spread through watering-hole attacks on compromised Ukrainian news and government sites. GTIG linked UNC6353 to Coruna and DarkSword in March 2026. On Android, UAC-0244 distributes CAMELSPY and UAC-0263 distributes BTMOB RAT, both via decoy apps.
- CERT-UA saw APT28 exploiting CVE-2026-21509 (Microsoft Office security feature bypass) to deliver COVENANT, and CVE-2026-8496 (zero-click flaw in SOGo webmail) to steal mailbox credentials and data. APT28 also used Roundcube XSS flaws and macro-laden Excel documents to spread COVENANT.
- Team Cymru identified five additional C2 servers for LegionRelay, a PowerShell RAT attributed to GREYVIBE that is active against Ukraine since at least August 2025.
Remediation
- Block or monitor the HOOKEDGE C2 IP and webhook[.]site traffic, and alert on hidden or headless Microsoft Edge launched from Office or script processes.
- Disable Office macros from untrusted sources and patch CVE-2026-21509 and CVE-2026-8496.
- Hunt for unexpected SSH key deployment, outbound SSH tunnels, curl executed over SSH, loopback listeners forcing NTLM authentication, and ld.exe.
- Restrict NTLM where possible and rotate credentials on hosts showing signs of compromise.