Skip to content
Hacker Posts

Symantec: Swallowtail (APT28) hit NATO naval shipbuilder

Symantec ties intrusions at a NATO naval shipbuilder and other defense targets to Swallowtail (APT28), using the HOOKEDGE backdoor and a new reflective loader. Full IOCs below.

Published 3 min read
threat-intelapt28swallowtailhookedge

Symantec's Threat Hunter Team reports a cluster of intrusions it tracks as Swallowtail — better known as APT28 / Fancy Bear / Forest Blizzard — against defense targets in two NATO member states, including a naval shipbuilder, a law-enforcement agency, and a maker of military aircraft engines. The campaign pairs the HOOKEDGE backdoor with a previously undocumented reflective loader, ld.exe. The primary source is Symantec's writeup, Swallowtail: Russia-Linked Group Targets NATO Members; The Hacker News corroborated it.

What Symantec attributes, and how

Symantec attributes the activity to Swallowtail. The US government has described the group as "a unit of Russia's military intelligence agency GRU" (CISA advisory AA25-141A). HOOKEDGE itself was first documented by Recorded Future's Insikt Group in August 2026, which tracks the operators as BlueDelta. Keep the nuance: this is a vendor attribution to a named, long-tracked cluster, not an indictment.

The intrusion

On the shipbuilder, Symantec describes hands-on-keyboard activity spread over about a week:

  • Initial access — a macro-enabled Word document with obfuscated VBA, run via an AutoOpen routine.
  • HOOKEDGE — a batch-script backdoor tasked through a hidden, off-screen Microsoft Edge instance, fetching tasks from webhook.site and later a hard-coded IP.
  • Credential theft — the attackers pushed an SSH private key and opened a persistent tunnel into the internal network, and ran a PowerShell script that forces NTLM authentication to a loopback listener to capture the handshake.
  • ld.exe — a reflective loader that decrypts a payload in memory and calls an exported ExecuteLoader. The payload (Events.dat) was not recovered, so the final objective is unknown.

Timeline on that host: the malicious document opened July 24; a second-stage script, the SSH tunnel and NTLM capture followed by July 27; ld.exe was delivered and run July 31; HOOKEDGE-linked artifacts were still seen as late as September 24, 2026.

Indicators

Published verbatim by Symantec Threat Hunter:

Network
  185.82.218[.]119
  hxxps://webhook[.]site/890efd8d-6e9e-428a-bcf9-987745d71000
  hxxps://webhook[.]site/53379b62-8020-41cf-af57-effa6e1e8506
  hxxps://webhook[.]site/5b73dc69-d765-4440-a4d2-e9eb33283eb9
  hxxps://webhook[.]site/d828b9fc-5435-4b1c-881f-d6350c11d0b6
  hxxps://webhook[.]site/ca3c058e-3c88-449b-8299-822cd5d5e17c

ld.exe reflective loader (SHA256)
  f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff

HOOKEDGE VBS launchers (SHA256)
  063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543
  d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40
  aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e

HOOKEDGE droppers (SHA256)
  4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303
  e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8
  e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe
  60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3
  1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e
  a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd
  6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f
  c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44
  ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb72
  5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645
  49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495
  39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b
  1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335
  e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c
  2fceca3460a35eea2b21c47d73c27c27edae95d2ae29ffb4ec2222d1a223b4bd
  68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7
  a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13

Filenames to watch: ld.exe and Events.dat, plus a renamed id_rsa SSH key.

Action checklist

  1. Block the IP and webhook.site URLs above and sweep historical DNS, proxy and firewall logs for them.
  2. Hunt the SHA-256 set across endpoints and mail gateways.
  3. Alert on macro-enabled Word documents spawning Edge off-screen and on PowerShell forcing NTLM auth to a loopback address — both are distinctive here.
  4. Review for unexpected outbound SSH tunnels and unauthorized authorized_keys / dropped private keys on internet-facing and jump hosts.

Context

A naval shipbuilder, an aircraft-engine maker and a law-enforcement agency is a defense-intelligence target set, and the tradecraft — document macros, living-off-the-land SSH, NTLM coercion — is deliberately quiet rather than destructive. The unrecovered payload is the open question: Symantec caught the loader, not the goal.

Related stories