Symantec: Russia's APT28 (Swallowtail, Fancy Bear) used the Hookedge backdoor against a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in two NATO countries; two-month shipbuilder intrusion with an SSH tunnel and a new in-memory loader
Symantec's Threat Hunter Team (Broadcom) reported on 20 October 2026, first covered by The Record on 19 October US time, that the GRU-linked group it calls Swallowtail (APT28, Fancy Bear, Forest Blizzard) targeted a naval shipbuilder, a manufacturer of military aircraft engines and a law enforcement agency in two unnamed European NATO member states. At the shipbuilder an employee opened a macro-enabled Word attachment on 24 July 2026, which dropped Hookedge, a backdoor first documented by Recorded Future's Insikt Group in August that fetches tasks through a hidden off-screen Microsoft Edge window and the webhook.site service. A second stage later moved to an attacker IP address, and over about a week of hands-on activity the operators planted an SSH private key to open a persistent reverse SSH tunnel from their server into the internal network, captured NTLM handshakes with a short PowerShell loopback listener, and deployed ld.exe, a previously undocumented reflective loader that decrypts a payload in memory only with a key passed at run time (the payload was not recovered). Activity ran from 24 July to at least 24 September. Symantec could not say whether data was stolen but says defence information was the likely aim and the campaign appears ongoing. No Australian targets were reported. Primary: Symantec; wire: The Record.
- Product
- Windows endpoints and Microsoft Office (macro-enabled Word documents); no software flaw
- Versions
- n/a — phishing with macro documents, no vulnerability exploited
- Exploited in Australia?
- unknown
- Patch to
- Block Office macros from internet-sourced files and alert on Word or Outlook-cache documents spawning wscript, cmd or a hidden msedge.exe. Treat outbound traffic to webhook.site from servers and engineering workstations as suspicious, and block 185.82.218.119. Alert on Windows OpenSSH (ssh.exe) opening outbound -R reverse tunnels or using keys under C:\ProgramData, and on PowerShell starting local HTTP listeners combined with net use to localhost. Hunt for ld.exe (SHA-256 f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff) and Events.dat in C:\ProgramData, and for repeated curl calls to webhook.site from scheduled tasks.
Primary: Symantec Threat Hunter Team — Swallowtail: Russian espionage group targets defense firms in two NATO countries (20 Oct 2026) · The Record — Defense contractors in two NATO allies hacked in recent Russia-linked campaign (19 Oct 2026 US)