APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
Threat actor
Swallowtail
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 20, 2026
- Last mentioned4d ago
Timeline
3 articles · newest firstAPT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
Appears with
- APT28threat actor · 3
- Hookedgemalware · 3
- Symantecorganization · 3
- Forest Blizzardthreat actor · 2
- Recorded Futureorganization · 2
- Microsoft Edgeproduct · 2
- GRUorganization · 2
- Microsoft Wordproduct · 2
- Fancy Bearthreat actor · 2
- Microsoftvendor · 1
- OpenSSHproduct · 1
- GREYVIBEthreat actor · 1
- BlueDeltathreat actor · 1
- LegionRelaymalware · 1
- UAC-0244threat actor · 1
- CAMELSPYmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.