APT28 uses Hookedge and an SSH tunnel against NATO defense firms
Original title: Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
Symantec’s Threat Hunter Team says Swallowtail, also tracked as APT28, Fancy Bear and Forest Blizzard, targeted a law enforcement agency, a naval shipbuilder and a military aircraft-engine maker in two NATO member states. At the shipbuilder, a malicious Word macro on July 24 dropped Hookedge, which used a hidden Microsoft Edge browser and webhook.site for tasks. Operators later stole credential material, opened a persistent SSH remote port forward and ran an undocumented in-memory loader whose encrypted payload was not recovered.
Unconfirmed: The purpose of the unrecovered Events.dat payload is unknown, and later Hookedge sightings may be persistence rather than new tasking.
- Initial infection was a macro-enabled Word file opened from Outlook’s attachment cache.
- Seven tasks arrived in about 30 seconds, consistent with interactive operator activity.
- A PowerShell listener captured NTLM challenge-response material that could support guessing or relay.
- ld.exe decrypted Events.dat in memory via ExecuteLoader; the payload itself was not recovered.
- The same loader and Hookedge launcher were seen again, including the launcher on September 24.
Impact: Stolen credentials and an SSH route into the internal network
- 1.Hunt suspicious Office macros, hidden Edge launches, webhook traffic, OpenSSH use and local NTLM listeners.
- 2.Review SSH keys and privileged credentials on affected hosts and rotate exposed credentials.
- 3.Check DNS and network logs for access to internal hosts and use Symantec’s published hashes.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1102 Web ServiceT1021.004 SSHT1187 Forced Authentication
- Threat actors
- SwallowtailAPT28Fancy BearForest BlizzardBlueDelta
- Malware
- Hookedge
- Organizations
- SymantecRecorded FutureGRU
- Countries
- Russia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303 | tivity. Indicators of Compromise File indicator Description 4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303 Hookedge dropper e068794cf43e381b26c82d746cca107b9f84327a2a |
| sha256 | 60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3 | 4946d2adc0870e97465f67526ea252bff0815abcbe Hookedge dropper 60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3 Hookedge dropper Note: IP addresses and domains are intenti |
| sha256 | e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8 | 729238779b6c99b10ee09f54c2cea1654a91561303 Hookedge dropper e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8 Hookedge dropper e8be50171436550e1edd8b4946d2adc0870e97465f |
| sha256 | e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe | 746cca107b9f84327a2a8308d5b87ea5529963c4c8 Hookedge dropper e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe Hookedge dropper 60ef547ebd2f4252e286db762980481b0da23dcd2c |
From the original article
3 min read at gbhackers.com
Swallowtail, the Russian espionage group also tracked as APT28, Fancy Bear and Forest Blizzard, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. The targets’ roles point to intelligence collection focused on national security and defense. The U.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.