APT28 Hackers Breach NATO Shipbuilder, Establish SSH Backdoor

Key Takeaways

• Russian state-sponsored group APT28 (also known as Fancy Bear or Forest Blizzard) breached a NATO-affiliated naval shipbuilder.
• The attack utilized the Hookedge backdoor, which facilitated credential theft and the establishment of a covert SSH tunnel for persistent access.
• The intrusion lasted for at least two months, with the attackers actively mapping the internal network and attempting to extract NTLM authentication responses.
• Similar Hookedge activity was observed targeting a law enforcement agency and a military aircraft engine manufacturer in a second NATO nation, underscoring a broader campaign.
• The final payload delivered by a reflective loader remains unidentified, leaving the full extent of potential data exfiltration unknown.

A sophisticated cyberespionage campaign attributed to the Russian state-sponsored hacking group APT28, identified by Symantec as “Swallowtail,” successfully compromised the network of a naval shipbuilder within a NATO member country. The attackers exploited the Hookedge backdoor to steal credentials and establish a hidden SSH tunnel, maintaining access for over two months. This operation aligns with a broader pattern of APT28’s activities targeting critical defense and government entities across NATO nations.

According to a detailed report from Symantec’s Threat Hunter Team, the intrusion involved a multi-stage attack that also impacted a law enforcement agency and a military aircraft engine manufacturer in a separate NATO member state. The report, while comprehensive in its technical analysis, refrained from disclosing the specific names of the affected organizations or countries involved, citing security concerns.

Initial Infiltration and Hookedge Deployment

The attack on the shipbuilder commenced on July 24, 2026, when an employee opened a malicious Microsoft Word document from an Outlook attachment. This document contained a hidden macro that initiated the infection chain, writing several files to the user’s profile. Among these files was the Hookedge backdoor, a versatile piece of malware designed to receive commands, execute them, and exfiltrate the results. The malware initially used a concealed Microsoft Edge browser window to communicate with webhook.site, a legitimate public web service. This tactic, leveraging common applications and services, likely aimed to evade detection by blending in with regular network traffic. Previous analyses of Hookedge campaigns have also documented this method of using Edge and webhook services for command and control (C2) operations.

Following the initial compromise, APT28 operators conducted preliminary reconnaissance, gathering basic system information and verifying connectivity to external services. After approximately a three-day pause, the attackers transitioned to a more aggressive phase. This involved establishing a dedicated C2 server at 185.82.218[.]119 for direct tasking and data transfer. Symantec’s analysis noted a rapid succession of seven commands executed within about 30 seconds, indicating direct, interactive control by the threat actors over the compromised system. You can find more details in Symantec’s full report on the incident here.

Persistent Access and Network Mapping

To ensure persistent access, the threat actors deployed an SSH private key on the compromised host, which was then used to establish an encrypted tunnel back to their C2 server. This SSH tunnel provided a robust and covert pathway directly into the shipbuilder’s internal network, differing from ephemeral remote sessions by offering a continuous presence. Shortly after the tunnel was established, the attackers began querying internal hostnames, a clear indicator of network reconnaissance aimed at mapping the victim’s infrastructure. This activity points to a methodical approach to understanding the network layout for future operations. Researchers from Symantec identified Hookedge activity at the three organizations, providing detailed insight into the attack chain here.

In addition to the SSH tunnel, APT28 attempted to harvest credentials using a PowerShell script. This script compelled the compromised machine to send an NTLM authentication response to a local listener. NTLM is a standard Windows protocol for user authentication, and capturing these responses can enable attackers to crack credentials offline or use them in pass-the-hash attacks to gain access to other systems within the network. The attackers continued to probe the network, examining account and group details, identifying additional internal systems, and collecting information on running processes and installed updates. While the SSH process was terminated the following day, the Hookedge backdoor remained active, periodically re-contacting the C2 server. The Symantec report could not confirm whether any sensitive shipbuilding data was exfiltrated or if the attackers penetrated further into the network.

This method of leveraging covert tunnels and legitimate services is consistent with APT28’s broader operational tactics. HackersRadar has previously reported on APT28’s exploitation of cloud services, emphasizing the necessity for organizations to scrutinize program behavior rather than solely relying on the reputation of accessed websites. On July 31, the attackers executed a program named ld.exe with an encrypted file, Events.dat. This loader decrypted its contents in memory and invoked an ExecuteLoader function. Symantec was unable to recover the final payload, leaving its ultimate purpose unknown. Despite this, the loader persisted on the host for weeks, and the Hookedge launcher was observed again on September 24, indicating continued access and potential for further malicious activity.

The coordinated use of a backdoor, credential theft, internal reconnaissance, and persistent tunnels highlights a sustained and strategic effort by APT28 to gain intelligence from high-value defense and government targets. While direct evidence of sensitive data exfiltration is not yet available, the comprehensive nature of the attack suggests a clear objective of long-term intelligence gathering.

What You Should Do

• Investigate Suspicious Attachments: Implement robust email security solutions and conduct user awareness training to identify and report suspicious Word documents or other attachments, especially those found in Outlook attachment caches.
• Monitor for Unauthorized Scripts: Regularly audit user profiles and system directories for unexpected or newly created scripts and executables.
• Detect Covert Browser Activity: Employ endpoint detection and response (EDR) solutions to monitor for hidden browser windows (e.g., Microsoft Edge) communicating with unusual or public web services like webhook.site.
• Audit SSH Connections: Scrutinize all SSH connections, particularly those originating from internal systems to external, unapproved servers. Ensure strict SSH key management and regularly rotate keys.
• Review Credential Exposure: Implement NTLM relay attack detection and prevention mechanisms. If NTLM credential exposure is suspected, immediately rotate affected credentials and investigate potential lateral movement.
• Analyze Logs: Proactively review endpoint, email, DNS, and proxy logs for the Indicators of Compromise (IoCs) listed below.
• Assume Persistent Threat: Treat any detected Hookedge activity as a potential ongoing intrusion rather than an isolated incident. Conduct thorough forensic investigations to ensure complete eradication of the threat.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution