APT28, a long-running cyberespionage group linked to Russian military intelligence, has been attributed to a campaign targeting a law-enforcement agency, a naval shipyard, and a military aircraft-engine manufacturer in two NATO countries. The intrusion stands out for prolonged hands-on-keyboard activity, two credential-theft techniques, a persistent SSH tunnel, and a previously undocumented reflective loader.
APT28 and the Swallowtail Campaign
Symantec's Threat Hunter Team tracks the activity cluster as Swallowtail; the same actor is also known as APT28, Fancy Bear, Forest Blizzard, or BlueDelta. The U.S. government assesses the group to be a unit of the GRU, Russia's military intelligence agency. Its traditional targets include government, military, diplomatic, and defense-industry organizations across Europe and North America.
All three reported victims held information of direct intelligence value: a law-enforcement agency, a naval shipyard, and a military aircraft-engine manufacturer. Their identities and countries were not disclosed, so the affected organizations should not be speculated about.
The Starting Point: A Word File Delivered by Email
At the shipyard, the first trace appeared on the afternoon of July 24, 2026, when a macro-enabled Word document was opened directly from Outlook's attachment cache. This confirms that the document arrived by email. Its obfuscated macro split VBA code and strings into short fragments that were reassembled at runtime to reduce detection by static scanners.
The AutoOpen routine dropped four files into the user profile: a VBScript launcher, an HTML/XHTML pair, and a batch script. This began the HOOKEDGE infection, a lightweight Windows script backdoor that receives commands and sends results to its command-and-control server.
HOOKEDGE Turns Edge Into a Command Channel
Instead of using a dedicated downloader, HOOKEDGE terminated running Microsoft Edge processes and opened a one-pixel Edge window off-screen. JavaScript embedded in a data URL requested a resource from webhook.site and forced the browser to save the response to disk. The batch script then converted the downloaded file into a command, executed it, returned the output, and deleted temporary files.
This technique uses a legitimate browser as an HTTP client, helping traffic blend into normal activity. The actor first tested access to Dropbox, Google, Microsoft, Mega, and an IP address, then collected proxy settings, logged-on sessions, processes, system information, and directory listings to assess the compromised host.
From a Public Service to Dedicated Infrastructure
On July 27, a new HOOKEDGE variant moved from webhook.site to the dedicated address 185.82.218[.]119:443 for tasking and data collection. Seven tasks ran in roughly 30 seconds, with commands two to eight seconds apart. The cadence and content indicate interactive operator activity rather than an automated schedule alone.
Initial commands established the user's identity and privileges before rapidly staging credential material. Over the following week, operators repeatedly returned to the host, resolved internal hostnames, and inventoried patches, showing that their objective extended beyond installing a backdoor to expanding their presence in the network.
An SSH Tunnel Creates a Route Back Into the Internal Network
The attackers pushed an SSH private key into ProgramData, changed its ownership, and used Windows' built-in OpenSSH client to connect back to their server. Remote port forwarding, background execution, and no interactive shell created a persistent tunnel that let adversary infrastructure route through the compromised host into the internal network.
Immediately after the tunnel came online, the actor resolved names and probed additional internal hosts. This is an important defensive signal: outbound SSH, particularly on an unusual port or paired with a newly created key in ProgramData, may represent persistence rather than administration.
A Second Technique: Forcing the Host to Authenticate With NTLM
APT28 also ran a short PowerShell script that created an HTTP listener on the loopback address and forced the host to authenticate to itself. The listener issued an NTLM challenge and captured up to four challenge-response pairs. These could support offline cracking attempts or authentication relay to another system where conditions allow.
Using two independent paths to obtain credentials demonstrates the campaign's adaptability. Even if one technique were blocked, the actor retained another option for privilege escalation or lateral movement.
The Previously Undocumented ld.exe Reflective Loader
On July 31, the actor delivered ld.exe together with the encrypted Events.dat. The tool receives a decryption key through command-line arguments, decrypts its payload in memory, and calls an exported function named ExecuteLoader. Reflective execution limits cleartext payload data written to disk and complicates file-based analysis.
Researchers recovered the loader, filename, and key used in one execution, but not the encrypted payload, so its final purpose remains unknown. This is an important evidentiary limit: the next-stage execution tool is confirmed, but the code that ran and any data taken cannot yet be determined.
The Campaign Lasted at Least Two Months
The last distinct operator activity was recorded in late July, but the same loader and VBS launcher remained on the host about four weeks later. The launcher appeared again on September 24, 2026. Symantec therefore assesses that the shipyard intrusion lasted at least two months.
No public evidence confirms that data was stolen. However, the network tunnel, credential collection, and lengthy persistence mean the incident should be treated as an ongoing compromise, not merely a blocked phishing email.
Priority Defensive Indicators
- Look for macro-enabled Word documents opened from the Outlook cache and AutoOpen chains that create VBS, HTML, or batch files in the user profile.
- Monitor Edge running off-screen, with unusual dimensions, or opening
data:text/html;base64. - Review connections to
185.82.218[.]119, the webhooks published by Symantec, and SSH processes establishing remote forwarding. - Find unusual
id_rsakeys in ProgramData, related ACL changes, and SSH commands enabling legacy RSA algorithms. - Detect PowerShell creating a local HttpListener, returning
WWW-Authenticate: NTLMor forcing connections to loopback. - Hunt for
ld.exeusing the vendor-published hash and analyze memory because the final payload may never exist in cleartext on disk.
Lessons for Defense and Critical-Infrastructure Organizations
The campaign shows how legitimate tools such as Edge, curl, PowerShell, and OpenSSH can be combined into a complete intrusion chain. Process names alone are insufficient; defenders must correlate command lines, process relationships, file locations, network destinations, and authentication behavior.
Organizations should also restrict Internet-sourced macros, isolate workstations from sensitive segments, control outbound SSH, reduce NTLM use, and retain process and network telemetry long enough for investigation. When HOOKEDGE is found, the investigation must expand to SSH keys, tunnels, credential material, and in-memory loaders rather than stopping at the initial document.
Conclusion
Swallowtail reflects APT28's persistent operating style: compromise through a familiar document, abuse of built-in tools, migration to dedicated infrastructure, and active control inside the network. The chain from HOOKEDGE to SSH tunneling, NTLM, and a reflective loader demonstrates the value of behavioral investigation across the full attack lifecycle, especially for organizations holding defense information.
VNCyberS compiled from Symantec Threat Hunter Team/Broadcom and The Hacker News
Tiếng Việt
English