APT28 at a NATO naval shipbuilder: two months inside, mostly using built-in Windows tools

On 20 October 2026, Symantec's Threat Hunter Team published details of a campaign by the group it tracks as Swallowtail. Other vendors call it APT28, Fancy Bear or Forest Blizzard; the US government attributes it to Russia's military intelligence service, the GRU. Three organisations in two NATO member states were affected: a law enforcement agency, a manufacturer of military aircraft engines and a naval shipbuilder. The report does not name the organisations or the countries.

For the shipbuilder, Symantec describes the sequence of events over several weeks in detail. That description is the basis of this article.

Sequence of events at the shipbuilder

24 July – initial access. An employee opens a Word document from the Outlook attachment cache, meaning it arrived as an email attachment. The macro is obfuscated: source code and strings are split into short fragments that are joined at runtime to evade static checks. It drops four files into the user profile: a VBScript launcher, two HTML/XHTML files and a batch script.

The batch script terminates running Edge processes, deletes incomplete downloads and restarts Edge. The window is 1×1 pixel in size and positioned off-screen, certificate validation is disabled, and the address is a data: URL containing Base64-encoded JavaScript. That JavaScript downloads a file from webhook.site. The batch script runs its contents as a command file and sends the output back to the same webhook.site address.

Recorded Future described this backdoor as Hookedge in August 2026. According to The Hacker News, it shares significant code with HEADLACE, which APT28 has used against diplomats since 2023.

A few minutes after the document is opened, an initial reconnaissance run starts. It checks whether Dropbox, Google, the Microsoft login portal, Mega and a single IP address are reachable, reads proxy and WPAD settings, and collects logged-on sessions, network configuration, system information, running processes and directory contents in the user profile and under Program Files. Symantec interprets the reachability checks as a search for usable channels for further downloads or exfiltration.

27 July – second stage. After three days without activity, a second, extended variant appears. It no longer receives commands via webhook.site but directly from 185.82.218.119 on port 443, and sends results back there. Seven commands arrive within about 30 seconds, two to eight seconds apart. Symantec assesses this as manual operation by an operator.

The attackers download a private SSH key, store it as C:\ProgramData\Adobe\id_rsa and adjust its file permissions. They then use the OpenSSH client built into Windows to connect to their server: port 80, host-key checking disabled, legacy RSA forced, process backgrounded, with remote port forwarding. According to Symantec's analysis, this creates a persistent tunnel through which the attackers can reach the internal network from their server. DNS lookups of internal hostnames follow immediately.

A few hours later the attackers use a second method to obtain authentication material. A short PowerShell script starts an HTTP listener on localhost:8080, answers requests with an NTLM challenge and uses net use to make the machine authenticate to that listener. This yields NTLMv2 challenge/response pairs that can be cracked offline or used for relay attacks against other systems. The script stores up to four such authentications. The method corresponds to tools such as Responder or ntlmrelayx, but here it works without a separate program.

Another hostname lookup and a check of privileges and group memberships follow.

28 July. DNS lookups of two further internal hostnames, one of which appears by its name to be a mail server, and a query of system information, processes and installed updates. A few hours later the attackers terminate the SSH process. The backdoor continues to contact the server every few hours.

31 July – loader. The attackers download two files and rename them ld.exe and Events.dat; ld.exe had already been on the system since the previous day. ld.exe is a previously undocumented reflective loader. It takes the path and key of an encrypted file as command-line arguments, decrypts it in memory and calls an exported function named ExecuteLoader. Symantec was unable to recover Events.dat, so what the loader executed is unknown.

Late August and 24 September. The loader and VBScript launcher remain on the system; the launcher is last observed on 24 September. Whether the scheduled task simply kept running or the attackers became active again cannot be determined from the available data.

Assessment

The attackers' own tools in this case are the script-based Hookedge backdoor and the ld.exe loader. All other steps – download, reconnaissance, tunnelling, credential capture – use programs present on current Windows systems: Edge, curl, ssh.exe, PowerShell, net.exe and standard command-line utilities.

This has a practical consequence for detection. Signature-based scanning covers at best the dropper documents and the two custom tools. The remaining steps can only be detected through the behaviour of the processes involved: process creation, command lines and network connections.

One detail concerns the loader. Without the key, Events.dat cannot be analysed; an antivirus engine or sandbox that only receives this file cannot inspect its contents. The key, however, appears in the command line of the process creation and is therefore contained in any log that records command lines. This is how Symantec obtained it.

Detection

The most meaningful individual indicators are the SSH invocation and the Edge launch. Outbound SSH connections with remote forwarding from a workstation to an external address are not expected in most environments. The combination of a 1×1-pixel window, an off-screen position and a data: URL does not occur in normal browser use. Both patterns can be implemented as rules with few false positives.

In both cases, the prerequisite is that process creation is logged with the full command line, either via Sysmon (event 1) or via Windows security event 4688 with command-line auditing enabled. Without this logging, little of the described sequence can be reconstructed on the endpoint.

Hardening

• Block macros in files from the internet. Since 2022, Office blocks macros in files carrying the Mark of the Web by default; Group Policy has allowed enforcing this since Office 2016. The report does not say whether this block was active at the shipbuilder. It is worth checking whether it is enforced across your own estate and which exceptions exist.
• Remove the OpenSSH client where it is not needed. It is installed by default on current Windows versions and can be removed with Remove-WindowsCapability or via software distribution. Allow outbound SSH at the perimeter firewall only from defined administration systems.
• Restrict NTLM. Enforce SMB signing and enable Extended Protection for Authentication to make relay attacks harder; enable NTLM auditing to understand actual NTLM usage, and restrict outbound NTLM where operations allow. Against offline cracking of captured responses, only sufficiently strong passwords help.
• Block webhook.site and similar services. Webhook testing services are not needed in most corporate networks and can be blocked at the proxy or via DNS filtering.
• Enable Attack Surface Reduction rules for Office, in particular "Block all Office applications from creating child processes". This rule would likely have prevented the launcher from being started from Word.

Indicators of Compromise

The following indicators come from the Symantec report. They are suitable for retrospective searches in existing logs. For detecting future attacks, the behavioural patterns in the Detection section are more suitable, as infrastructure and hashes are easily replaced.

Network

Files (SHA256)

Symantec additionally lists 17 hashes of Hookedge dropper documents; the full list is in the original report.

Host artefacts: C:\ProgramData\Adobe\id_rsa, C:\ProgramData\ld.exe, C:\ProgramData\Events.dat, command-line argument DE063CF3F2E2A83E7B1A277C052A340E, port 48097 in the SSH invocation, files with the .000 extension in the Downloads folder.

Relevance for suppliers and NIS2 entities

Symantec describes the three targets as organisations whose information is of interest to a foreign intelligence service. In our assessment, the same applies to their suppliers, such as component manufacturers, engineering service providers or vendors of control systems. These companies often have fewer security staff and less monitoring than their customers. The techniques described require no special conditions on the victim's side and transfer directly to such environments.

For entities in scope of NIS2, supply-chain security is explicitly part of the risk-management measures under Article 21(2)(d). An undetected compromise at a supplier can affect the customer's data and, depending on how the supplier is connected, open a route into the customer's network.

Symantec recommends treating any finding of Hookedge indicators as a potentially ongoing incident and specifically searching for credential theft and tunnel connections, rather than assuming the backdoor installation represents the full extent of the compromise.