APT28 breaches NATO naval shipbuilder, deploys reflective loader
Original title: Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
Symantec, tracking the cluster as Swallowtail, attributes attacks on two NATO member states to APT28. Targets included a law enforcement agency, a naval shipbuilder and a military aircraft-engine manufacturer. Against the shipbuilder in late July 2026, operators returned for about a week, deployed HOOKEDGE variants that use 185.82.218[.]119, stole credentials with an SSH key and a loopback NTLM capture, and dropped reflective loader ld.exe. The same report also covers GREYVIBE’s LegionRelay servers and CERT-UA findings on Russian targeting of Ukrainian phones.
Unconfirmed: The payload run by ld.exe is unknown, and victim organizations are not named.
- HOOKEDGE is a Windows batch backdoor previously seen via macro-enabled Word documents.
- Earlier HOOKEDGE use targeted government and diplomatic bodies in Romania, Spain and Türkiye.
- Team Cymru listed five additional LegionRelay C2 servers used against Ukrainian entities.
- CERT-UA says DarkSword was delivered through watering holes on Ukrainian news and government sites.
Impact: Credential theft, persistent access and possible espionage data collection
- ATT&CK
- T1566.001 Spearphishing AttachmentT1187 Forced AuthenticationT1021.004 SSHT1620 Reflective Code Loading
- Vendors
- Microsoft
- Products
- Microsoft WordMicrosoft Edge
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | webhook.site | icrosoft Word documents and communicates entirely through a webhook[.]site URL, which acts as a channel to stage tasks and to receiv |
| ipv4 | 166.88.239.54 | listed below - 91.149.221[.]118:8000 91.149.221[.]123:8000 166.88.239[.]54:8000 194.87.108[.]12:8000 194.87.108[.]217:8000 LegionRel |
| ipv4 | 185.82.218.119 | use of webhook[.]site in favor of a dedicated IP address ("185.82.218[.]119:443" for both tasking and exfiltration. "The attackers us |
| ipv4 | 194.87.108.12 | 9.221[.]118:8000 91.149.221[.]123:8000 166.88.239[.]54:8000 194.87.108[.]12:8000 194.87.108[.]217:8000 LegionRelay is the name assign |
| ipv4 | 194.87.108.217 | 49.221[.]123:8000 166.88.239[.]54:8000 194.87.108[.]12:8000 194.87.108[.]217:8000 LegionRelay is the name assigned to a PowerShell-bas |
| ipv4 | 91.149.221.118 | ing Ukrainian entities. The IP addresses are listed below - 91.149.221[.]118:8000 91.149.221[.]123:8000 166.88.239[.]54:8000 194.87.10 |
| ipv4 | 91.149.221.123 | . The IP addresses are listed below - 91.149.221[.]118:8000 91.149.221[.]123:8000 166.88.239[.]54:8000 194.87.108[.]12:8000 194.87.108 |
From the original article
4 min read at thehackernews.com
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.