Threat feed

APT28 Hookedge NATO campaign

Swallowtail/APT28 NATO espionage: Hookedge delivery, planted-key SSH tunnel, loopback NTLM capture and a runtime-key loader

Posted · Updated · Spectrum Delta Research Team

Summary

Symantec's Threat Hunter Team (Oct 20, A/3) documents a successful two-month APT28/Swallowtail (GRU-linked) espionage intrusion at a European naval shipbuilder, part of a campaign compromising three national-security-relevant organizations across two unnamed NATO countries (a naval shipbuilder, a military aircraft engine maker, a law enforcement agency). The intrusion chain: a macro-enabled Word attachment dropped the Hookedge backdoor, which used a hidden one-pixel off-screen Microsoft Edge window as its HTTP client to fetch tasks from webhook.site; operators then planted an SSH private key, opened a persistent tunnel to their server, captured NTLM handshakes via a loopback PowerShell listener, and ran an undocumented reflective loader (ld.exe) whose encrypted payload was never recovered. Whether any data was stolen is not established.

Breakdown

Adversary

Swallowtail

Procedures (4)

  1. Hookedge chain: obfuscated macro to hidden-Edge C2 client

    Visual Basic macro chain with browser-as-C2-client

    • T1059.005Command and Scripting Interpreter: Visual Basic

    Logs

    • Windows EDR / Sysmon process+file · Macro children; 1px Edge window; ssh.exe tunnel args; ld.exe key invocation
    • Email gateway · Macro-enabled Word attachment delivery to defense/government staff

    Detectors

    No known detector

Click to expand remaining (3) procedures

  1. Planted-key persistent SSH tunnel into internal network

    Protocol tunneling: planted-key SSH route into the internal network

    • T1572Protocol Tunneling

    Logs

    • Windows EDR / Sysmon process+file · Macro children; 1px Edge window; ssh.exe tunnel args; ld.exe key invocation
    • Network / DNS / proxy · webhook.site endpoints; 185.82.218.119; forward port 48097; connectivity probes

    Detectors

    No known detector

  2. Loopback NTLM self-capture via PowerShell

    Adversary-in-the-middle family: loopback NTLM self-capture

    • T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay

    Logs

    • Windows EDR / Sysmon process+file · Macro children; 1px Edge window; ssh.exe tunnel args; ld.exe key invocation

    Detectors

    No known detector

  3. Reflective loader ld.exe with runtime decryption key

    Reflective code loading: ld.exe with runtime decryption key

    • T1620Reflective Code Loading

    Logs

    • Windows EDR / Sysmon process+file · Macro children; 1px Edge window; ssh.exe tunnel args; ld.exe key invocation

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Symantec (https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets), A/3) — operator server 185.82.218[.]119 (HTTPS 443 tasking, SSH port 80, remote dynamic forward 48097); webhook.site tasking endpoints: 890efd8d-6e9e-428a-bcf9-987745d71000 (initial), 53379b62-8020-41cf-af57-effa6e1e8506 (second-stage installer/scheduled task), 5b73dc69-d765-4440-a4d2-e9eb33283eb9 (C2 session), d828b9fc-5435-4b1c-881f-d6350c11d0b6, ca3c058e-3c88-449b-8299-822cd5d5e17c; connectivity-probe IP 23.220.75.245 (plus dl.dropboxusercontent.com, accounts.google.com, login.microsoftonline.com, mega.nz, example.com); planted key C:\ProgramData\Adobe\id_rsa; loader C:\ProgramData\ld.exe (SHA-256 f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff) with encrypted payload C:\ProgramData\Events.dat, decryption key DE063CF3F2E2A83E7B1A277C052A340E, decrypted marker ADSA (0x41534441), exported function ExecuteLoader; 17 Hookedge dropper SHA-256s and 3 VBS-launcher SHA-256s in the thread; first infection 24 July 2026, last observed activity 24 September 2026. Assessed 2026-10-24, hunt-only — the webhook.site UUIDs and IP are perishable attacker infrastructure; the durable hunt value is the behavioral chain (macro chain, hidden-Edge C2, tunnel arguments, loopback NTLM capture, loader invocation).

Detailed

Operator server: 185.82.218[.]119 — HTTPS 443 (second-stage tasking/output), SSH port 80 (tunnel, root, legacy RSA, no host-key check), remote dynamic forward 48097. webhook.site endpoints: hxxps://webhook[.]site/890efd8d-6e9e-428a-bcf9-987745d71000 (initial tasking), /53379b62-8020-41cf-af57-effa6e1e8506 (installer/scheduled task), /5b73dc69-d765-4440-a4d2-e9eb33283eb9 (C2 session), /d828b9fc-5435-4b1c-881f-d6350c11d0b6, /ca3c058e-3c88-449b-8299-822cd5d5e17c. Connectivity probes: 23.220.75.245, dl.dropboxusercontent.com, accounts.google.com, login.microsoftonline.com, mega.nz, example.com (HTTPS+HTTP). Planted key: C:\ProgramData\Adobe\id_rsa (ownership/permissions changed for a named local account). Loader: C:\ProgramData\ld.exe, SHA-256 f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff, payload C:\ProgramData\Events.dat, key DE063CF3F2E2A83E7B1A277C052A340E, decrypted marker ADSA (0x41534441), export ExecuteLoader. Hookedge dropper SHA-256s (17): 4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303, e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8, e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe, 60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3, 1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e, a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd, 6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f, c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44, ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb72, 5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645, 49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495, 39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b, 1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335, e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c, 2fceca3460a35eea2b21c47d73c27c27edae95d2ae29ffb4ec2222d1a223b4bd, 68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7, a92413d4951a28822ec8515c0d1948d4160b91388c5f3d86504611fc286a4d13. VBS launcher SHA-256s (3): 063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543, d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40, aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e. Timeline: infection 24 July 2026 (afternoon), tunnel 27 July, tunnel killed 28 July, loader 31 July, beaconing to 31 July, artifacts present late August, launcher observed 24 September (most recent). All from the primary (Symantec (https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets), A/3), assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of APT28 Hookedge NATO campaign? Bring them to the community.

Discuss in the Tradecraft Slack