Securify

Russia’s most notorious military hacking unit has breached a naval shipbuilder in a NATO member state, deploying a previously unknown reflective loader and an upgraded version of a backdoor that hides its traffic inside ordinary Microsoft Edge browser sessions. The campaign, disclosed by Symantec’s Threat Hunter Team on October 20, underscores a troubling escalation in Russian cyberespionage against Western defense infrastructure.

What Happened

Symantec tracks the activity cluster as “Swallowtail,” but the threat actor behind it is far better known as APT28 — also called Fancy Bear, BlueDelta, and Forest Blizzard. The U.S. government attributes the group to Russia’s GRU military intelligence agency. According to Symantec’s report, the campaign targeted organizations in two unnamed NATO countries, hitting three high-value entities: a law enforcement agency, a manufacturer of military aircraft engines, and, most critically, a naval shipbuilder.

All three targets likely held classified or sensitive information of direct interest to a foreign intelligence service — the kind of data that could inform everything from warship design and naval strategy to fighter jet propulsion technology.

Inside the Naval Shipbuilder Breach

The most detailed case in the report centers on the naval shipbuilder, where the intrusion began on July 24, 2026. A user opened a malicious Word document directly from an Outlook attachment cache — a classic spear-phishing vector — which kicked off the infection chain for a backdoor called HOOKEDGE.

HOOKEDGE is, on its face, deceptively simple: a Windows batch script that fetches commands, executes them, and returns results. But its delivery mechanism is what makes it stand out. Rather than using a custom downloader or abusing well-known Windows utilities like certutil or bitsadmin that defenders commonly flag, HOOKEDGE launches a hidden, off-screen instance of Microsoft Edge. That invisible browser window contacts a webhook.site URL — a legitimate, free web service — to retrieve tasking instructions. Command output is written to a local HTML file, and a second hidden Edge process opens it, triggering an automatic HTTP POST to a separate operator-controlled endpoint. To network monitoring tools, the traffic looks like routine browser activity.

Recorded Future’s Insikt Group first documented HOOKEDGE in August 2026, noting its significant code and tradecraft overlap with HEADLACE, a modular implant APT28 has used against diplomats since at least April 2023. The earlier HOOKEDGE campaign, running from September 2025 through early April 2026, targeted government and diplomatic organizations in Romania, Spain, and Türkiye with lures impersonating Spain’s Ministry of the Presidency.

Hands-on-Keyboard Escalation

What happened after initial access at the shipbuilder shows an operator who moved deliberately. Within hours of the document being opened, a reconnaissance batch script checked outbound connectivity to Dropbox, Google, Microsoft, and Mega cloud services, queried the network’s proxy and WPAD settings, and swept sessions, processes, and directory structures.

After a three-day pause — possibly waiting for a more experienced operator or for the right window — the attackers returned on July 27 with a second-stage HOOKEDGE variant. This version ditched webhook.site entirely in favor of a dedicated IP address (185.82.218.119) for both tasking and data exfiltration, a sign the operators treated this target as high-priority and wanted tighter control over their command-and-control infrastructure.

Over the next several days, seven commands ran in rapid succession — consistent with a live, hands-on-keyboard session. The operators staged an SSH private key on the compromised host, adjusted its permissions, and used it to open a persistent, backgrounded SSH tunnel back to their server. This tunnel created a dynamic forward into the organization’s internal network. DNS lookups of internal hostnames, including what appeared to be a mail server, followed almost immediately.

In a parallel credential-theft effort, the operators deployed a PowerShell script that set up a fake HTTP listener on the machine’s loopback address and forced the host to authenticate to it over an SMB-over-HTTP path. This captured NTLMv2 handshakes — up to four attempts — giving the attackers crackable password hashes that could unlock deeper access to the network.

A New Weapon: The Reflective Loader

On July 31, the campaign took another leap. Operators pushed a previously undocumented tool — a reflective loader named ld.exe — along with an encrypted payload file called Events.dat. The loader accepts a decryption key and payload path as command-line arguments, decrypts the file in memory (identified by the marker “ADSA”), and calls an exported function named ExecuteLoader to run the next-stage component entirely without touching disk.

Symantec noted this tradecraft “goes beyond the delivery mechanism that has so far been publicly reported” for APT28. The encrypted payload was not recovered, so its ultimate function remains unknown — but the investment in a fileless, in-memory execution chain suggests the group is actively evolving its toolkit to evade endpoint detection and response (EDR) solutions.

Who Is Affected and Why It Matters

The targeting of a naval shipbuilder and a military aircraft engine manufacturer is not random. Both sit at the heart of NATO’s defense-industrial base. Compromising these organizations could yield technical blueprints, procurement data, production schedules, or communications that would give Russia a strategic intelligence advantage — particularly as NATO continues to bolster its eastern flank and modernize its naval and air capabilities.

This campaign also arrives alongside a broader surge in Russian cyber operations. CERT-UA recorded 3,137 incidents in the first half of 2026 alone, about 8% more than in the second half of 2025. APT28 specifically has been exploiting CVE-2026-21509, a Microsoft Office security feature bypass, to deliver COVENANT malware, and CVE-2026-8496, a zero-click flaw in SOGo webmail, to steal mailbox credentials from Ukrainian targets.

Practical Takeaways

Hunt for the technique, not just the tool. HOOKEDGE’s use of legitimate Edge browser processes for C2 means traditional IOC-based detection may miss it. Defenders should flag Edge launches that are hidden, that open local HTML files without user interaction, or that generate outbound requests to webhook.site from unexpected hosts.

Watch for credential-theft staging. SSH private keys appearing under C:\ProgramData, PowerShell scripts setting up HTTP listeners on loopback, and SSH tunnels with dynamic forwarding to external IPs are all indicators of hands-on-keyboard operator activity that warrants immediate investigation.

Restrict macros aggressively. The initial access vector was a macro-enabled Word document opened from an email attachment. Organizations that have not yet enforced Microsoft’s default macro-blocking policy for internet-sourced documents should do so immediately.

Treat any HOOKEDGE indicator as an active intrusion. Symantec’s report makes clear that the operators returned repeatedly over days to weeks. A single detection should trigger a full-scope investigation, not just remediation of the initial artifact.

The Swallowtail campaign is a reminder that Russia’s cyber-intelligence apparatus is not standing still. As APT28 refines its tradecraft — swapping commodity web services for dedicated infrastructure, adding fileless loaders, and hiding inside trusted applications — defenders in the defense-industrial base need to be hunting proactively, not waiting for alerts.