APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries
Do Son 
| At a glance | |
| Actor | Swallowtail (APT28, Fancy Bear, Forest Blizzard), linked by the US government to Russia’s GRU |
| Activity | Cyber espionage using the Hookedge backdoor, credential theft, and SSH tunneling |
| Targets | A law enforcement agency, a naval shipbuilder, and a military aircraft engine maker |
| Scale | Organizations in two NATO member states; one intrusion lasted at least two months |
| Status | No law-enforcement action reported for this campaign |
| Source | Symantec and Carbon Black Threat Hunter Team, building on Recorded Future’s Insikt Group |
TL;DR
On July 24, 2026, a staff member at a NATO-country naval shipbuilder opened a booby-trapped Word attachment. That file installed the Hookedge backdoor, and APT28 then stayed inside for at least two months. Symantec says the same campaign also hit a law enforcement agency and an aircraft engine maker.
What happened
Symantec’s Threat Hunter Team tracks the group as Swallowtail. Other vendors call it APT28, Fancy Bear, or Forest Blizzard. In this campaign, it targeted three organizations in two NATO states. According to Symantec, all three “were likely to hold information of direct interest to a foreign intelligence service.”
A hidden browser as a downloader
The attack began with a macro-enabled Word file sent by email. Its macro split code into small fragments to slip past antivirus scans. Once opened, it dropped four files to start the Hookedge backdoor.
Instead of a normal downloader, Hookedge used Microsoft Edge itself. A script launched a one-pixel Edge window placed off-screen. That hidden browser fetched tasks from the public webhook.site service and saved them to disk. Later, the script sent the results back to the same service.
The first task mapped the host. It also tested whether the machine could reach Dropbox, Google, Microsoft, and Mega. Symantec believes the attackers were checking which channels they could use for staging or data theft.
From webhook to private server
Three days later, a second-stage Hookedge component appeared. This version dropped webhook.site and talked to an attacker-run server instead. Seven commands then arrived within 30 seconds. Symantec says this pace fits “an operator working interactively rather than a fixed polling timer.”
Two ways to steal credentials
Next, the operators pushed an SSH private key onto the host. They used it to open a persistent tunnel back to their own server. This gave them a route into the shipbuilder’s internal network. Soon after, they began looking up internal hostnames, including what appeared to be a mail server.
They also ran a short PowerShell script that tricked the machine into logging in to itself. This captured NTLM login data. Attackers can crack that data offline or relay it to other hosts.
A new loader with a missing key
On July 31, the operators ran a previously unknown tool called ld.exe. It decrypts an encrypted file in memory and runs it. However, the payload only works with a key supplied at run time. Symantec recovered the key but not the payload, so its purpose remains unknown.
Who is behind it
Symantec attributes the activity to Swallowtail. The US government has publicly described this group as a unit of Russia’s military intelligence agency, the GRU. The group gained wide attention in 2016, when it was linked to the hack of the Democratic National Committee.
In addition, Recorded Future’s Insikt Group first documented the Hookedge backdoor in August 2026. That team tracks the same group as BlueDelta. No individuals have been named or charged over this campaign.
Impact and scale
Symantec has not said what data, if any, left the shipbuilder. Still, the access was deep. The tunnel, stolen credentials, and internal scans point to plans to move further into the network.
The intrusion also lingered. The loader and the Hookedge launcher were still on the host in late August. The launcher was seen again on September 24, the latest activity recorded.
Overall, Symantec sees a broad effort against European government and defense targets, not a single focused hit.
What comes next and how to stay protected
Symantec warns that groups finding Hookedge “should treat the intrusion as potentially ongoing rather than concluded.” Key steps include:
- Block or warn on macro-enabled Office files from email.
- Flag Edge launched with tiny, off-screen windows or inline data payloads.
- Monitor traffic to webhook.site and similar request-capture services.
- Alert on outbound SSH from workstations, especially over port 80.
- Watch for local HTTP listeners that trigger NTLM logins to the same machine.
- Hunt for unknown loaders in ProgramData that take a key on the command line.
- Reset credentials for any user or machine account on an affected host.
In short, the Hookedge backdoor was only the entry point. For defense firms, the real risk lies in what APT28 does after it gets in.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
