APT28 targets NATO shipbuilder with HOOKEDGE and reflective loader
Russia-linked threat actor APT28 breached a naval shipbuilder in a NATO member state in late July 2026, deploying the HOOKEDGE backdoor and a previously undocumented reflective loader named ld.exe. Symantec’s Threat Hunter Team tracks this activity cluster as Swallowtail and said it also targeted a law-enforcement agency and a manufacturer of military aircraft engines.
The affected organisations hold information that could be valuable to a foreign intelligence service. In the shipbuilder intrusion, operators returned to a compromised machine repeatedly over the course of a week, behaviour Symantec assessed as hands-on-keyboard activity.
Credential theft and an internal access route
Symantec observed two separate credential-theft techniques after the initial compromise. In one, the attackers placed an SSH private key on the victim host and immediately used it to connect back to their own server. The connection requested a persistent, backgrounded SSH tunnel, creating a route from attacker infrastructure into the organisation’s internal network.
In the second technique, the operators ran a short self-contained PowerShell script. It opened a listener on the host’s loopback address and forced the system to authenticate to it, allowing the attackers to capture the resulting NTLM handshake.
The group then used curl over SSH to drop ld.exe. The reflective loader is designed to decrypt and execute an encrypted next-stage component in memory with a cryptographic key supplied at runtime. Symantec said the nature of that payload remains unknown.
HOOKEDGE changes its communications method
APT28, also known as BlueDelta, Fancy Bear and Forest Blizzard, was publicly linked to HOOKEDGE by Recorded Future’s Insikt Group in August 2026. That reporting described espionage activity against government and diplomatic organisations in Romania, Spain and Türkiye between September 2025 and early April 2026.
HOOKEDGE is a minimal Windows batch-script backdoor that accepts commands and returns their results. It has been delivered in macro-enabled Microsoft Word documents and shares significant code and operational overlap with HEADLACE, a modular Windows implant used by APT28 against diplomats since April 2023.
Earlier HOOKEDGE activity used webhook[.]site as a channel for task staging and execution output. Compromised devices retrieved tasks through a hidden, off-screen Microsoft Edge browser instance rather than a conventional downloader. In the shipbuilder attack, however, new HOOKEDGE variants used the dedicated address 185.82.218[.]119:443 for both tasking and exfiltration.
Defensive implications for sensitive organisations
Symantec said the post-access tradecraft—two independent credential-theft methods, a persistent tunnel and a new loader—went beyond the delivery mechanism publicly reported for the campaign. The intrusion shows why organisations handling defence, law-enforcement or other sensitive information need visibility after initial access as well as controls against malicious documents.
Business security teams should investigate unexpected SSH keys and persistent tunnels, scrutinise PowerShell activity that triggers local authentication, and correlate curl downloads with SSH sessions. Monitoring outbound connections to unfamiliar tasking infrastructure can help teams identify activity that persists after the initial compromise.