Threat actorhigh
APT28 used Hookedge to tunnel into NATO shipbuilder
Original title: APT28 Hackers Open Secret SSH Tunnel Into NATO Country’s Naval Shipbuilder Network
AI summary · x-ai/grok-4.7Summaries by Vani AI
The unnamed intrusion began July 24, 2026, via a Word macro and lasted at least two months.
Symantec’s Threat Hunter Team says Russian group APT28, also called Fancy Bear, Forest Blizzard, and Swallowtail, used the Hookedge backdoor against a naval shipbuilder in an unnamed NATO country. A malicious Word document from the Outlook attachment cache started the chain; operators later used webhook.site, an SSH tunnel, and NTLM capture. The same Hookedge activity was seen at a law-enforcement agency and a military aircraft-engine maker in a second NATO state. Whether sensitive shipbuilding data was taken is not confirmed.
Unconfirmed: The shipbuilder, country, tunnel’s purpose, and whether data or further systems were accessed are not confirmed.
Key facts
- After about three days, tasking moved to 185.82.218[.]119, with seven commands in about 30 seconds.
- Operators planted an SSH private key and mapped internal hostnames through the tunnel.
- A PowerShell script prompted an NTLM authentication response to a local listener.
- On July 31, ld.exe was run with encrypted Events.dat; that payload was not recovered.
- Hookedge’s launcher was seen again on September 24, and the loader remained weeks later.
Security assessment · AI, from the article
Impact: Backdoor access, credential material, and a persistent internal SSH tunnel
What to do
- 1.Hunt Word attachments, hidden Edge activity, unexpected user-folder scripts, and unapproved SSH connections.
- 2.Review endpoint, email, DNS, and proxy logs for the published Hookedge indicators.
- 3.Check for NTLM exposure and rotate credentials if compromise is suspected.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | webhook.site | der IP address 185.82.218[.]119 Operator server URL hxxps://webhook[.]site/890efd8d-6e9e-428a-bcf9-987745d71000 Hookedge endpoint UR |
| ipv4 | 185.82.218.119 | ed with a more active stage that used a dedicated server at 185.82.218[.]119 for tasking and data transfer. Symantec observed a burst |
| sha256 | 063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543 | d4160b91388c5f3d86504611fc286a4d13 Hookedge dropper SHA-256 063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543 Hookedge VBS launcher SHA-256 d74c65e6d35d3b2a80686f059590f |
| sha256 | 1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e | 1b0da23dcd2c84465509735544c0a9c2b3 Hookedge dropper SHA-256 1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e Hookedge dropper SHA-256 a3b44405112e6364444e7d96630edfabcf |
| sha256 | 1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335 | 8b207c71ec1d266bb049b54b7eaf01d67b Hookedge dropper SHA-256 1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335 Hookedge dropper SHA-256 e94402a9886d4433ccad0ced0cd4f22d05 |
| sha256 | 39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b | c2a0c25e75ac621cd6a203d64fb75aa495 Hookedge dropper SHA-256 39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b Hookedge dropper SHA-256 1bff55104206d3f55cd72ca58ffecd2fa6 |
| sha256 | 49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495 | c4595f881b4865ebf6e490784b56105645 Hookedge dropper SHA-256 49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495 Hookedge dropper SHA-256 39d21c1b8ab2f08c75a1cb7d18433a8b20 |
| sha256 | 4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303 | s of compromise (IoCs):- Type Indicator Description SHA-256 4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303 Hookedge dropper SHA-256 e068794cf43e381b26c82d746cca107b9f |
| sha256 | 5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645 | f71004e1bd43e2e1ed953edad51118cb72 Hookedge dropper SHA-256 5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645 Hookedge dropper SHA-256 49e276498fc4e7d65ebf9fa2acf64ec2a0 |
| sha256 | 60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3 | c0870e97465f67526ea252bff0815abcbe Hookedge dropper SHA-256 60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3 Hookedge dropper SHA-256 1bb1b27e1695c726c7c1d3d4935f9318af |
| sha256 | 6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f | abcf81e5ad37d690c3ebc73770d62aeabd Hookedge dropper SHA-256 6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f Hookedge dropper SHA-256 c2c9187033d22d7944ea9298461a0ac693 |
| sha256 | 68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7 | 27edae95d2ae29ffb4ec2222d1a223b4bd Hookedge dropper SHA-256 68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7 Hookedge dropper SHA-256 a92413d4951a28822ec85e5c0d1948d416 |
| sha256 | a3b44405112e6364444e7d96630edfabcf81e5ad37d690c3ebc73770d62aeabd | 18afc6f5fd9015d7cf3890f0eb7bf8d47e Hookedge dropper SHA-256 a3b44405112e6364444e7d96630edfabcf81e5ad37d690c3ebc73770d62aeabd Hookedge dropper SHA-256 6678049918dda2d5859de0a95e0573fec9 |
| sha256 | a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13 | 12bd4c4e940f4d0c9e702e7c35a256d0f7 Hookedge dropper SHA-256 a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13 Hookedge dropper SHA-256 063930af6a4aad06d8f8aab43226bf6dcd |
| sha256 | aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e | ecaf4ed539192e904d675ba5c7a40 Hookedge VBS launcher SHA-256 aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e Hookedge VBS launcher SHA-256 f1cc91e7427a22027f65d31bbee19 |
| sha256 | c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44 | fec9496c62bbe72967ae0d3deeb5bda68f Hookedge dropper SHA-256 c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44 Hookedge dropper SHA-256 ea525336b787c2fd3dbc4b3e9a3a78f710 |
| sha256 | d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40 | d2c79aa505894ee95876cf9254543 Hookedge VBS launcher SHA-256 d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40 Hookedge VBS launcher SHA-256 aafbc096e20f259df9166f837d0ba |
| sha256 | e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8 | 9b6c99b10ee09f54c2cea1654a91561303 Hookedge dropper SHA-256 e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8 Hookedge dropper SHA-256 e8be50171436550e1edd8b4946d2adc087 |
| sha256 | e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe | 7b9f84327a2a8308d5b87ea5529963c4c8 Hookedge dropper SHA-256 e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe Hookedge dropper SHA-256 60ef547ebd2f4252e286db762980481b0d |
| sha256 | e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c | 2fa620a428c5a3c6987d3c4cc68285d335 Hookedge dropper SHA-256 e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c Hookedge dropper SHA-256 2fceca3460a35eea2c1c47d73c27c27eda |
| sha256 | ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb72 | c693ef2774b4ce08b0955d2aba3646fb44 Hookedge dropper SHA-256 ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb72 Hookedge dropper SHA-256 5709e5e1496410d4b9ac5a3bd8be3ec459 |
| sha256 | f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff | 177e6f383ca7cb9215936ecbe7f5e Hookedge VBS launcher SHA-256 f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff ld.exe reflective loader IP address 185.82.218[.]119 Operat |
| url | https://webhook.site/53379b62-8020-41cf-af57-effa6e1e8506 | /890efd8d-6e9e-428a-bcf9-987745d71000 Hookedge endpoint URL hxxps://webhook[.]site/53379b62-8020-41cf-af57-effa6e1e8506 Hookedge endpoint URL hxxps://webhook[.]site/5b73dc69-d76 |
| url | https://webhook.site/5b73dc69-d765-4440-a4d2-e9eb33283eb9 | /53379b62-8020-41cf-af57-effa6e1e8506 Hookedge endpoint URL hxxps://webhook[.]site/5b73dc69-d765-4440-a4d2-e9eb33283eb9 Hookedge endpoint URL hxxps://webhook[.]site/d828b9fc-543 |
| url | https://webhook.site/890efd8d-6e9e-428a-bcf9-987745d71000 | tive loader IP address 185.82.218[.]119 Operator server URL hxxps://webhook[.]site/890efd8d-6e9e-428a-bcf9-987745d71000 Hookedge endpoint URL hxxps://webhook[.]site/53379b62-802 |
| url | https://webhook.site/ca3c058e-3c88-449b-8299-822cd5d5e17c | /d828b9fc-5435-4b1c-881f-d6350c11d0b6 Hookedge endpoint URL hxxps://webhook[.]site/ca3c058e-3c88-449b-8299-822cd5d5e17c Hookedge endpoint Note: IP addresses and domains are inte |
| url | https://webhook.site/d828b9fc-5435-4b1c-881f-d6350c11d0b6 | /5b73dc69-d765-4440-a4d2-e9eb33283eb9 Hookedge endpoint URL hxxps://webhook[.]site/d828b9fc-5435-4b1c-881f-d6350c11d0b6 Hookedge endpoint URL hxxps://webhook[.]site/ca3c058e-3c8 |
From the original article
4 min read at cybersecuritynews.com
Russian cyberespionage group APT28 used the Hookedge backdoor to reach a naval shipbuilder’s network in a NATO member state, steal login material and set up a hidden SSH tunnel. The intrusion lasted at least two months, according to a report by Symantec’s Threat Hunter Team. The report does not name the shipbuilder or the country.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.