Swallowtail Used Hookedge, Credential Theft and SSH Tunneling in NATO Defense Intrusion
Summary
Symantec traced Swallowtail activity against targets in two NATO countries, including a naval shipbuilder. Its investigation details Hookedge delivery, credential theft, a persistent SSH tunnel and an undocumented loader; the final payload was not recovered.
Key points
- Symantec reported Swallowtail (also known as APT28) targeting a law enforcement agency, a naval shipbuilder and an aircraft-engine manufacturer in two NATO member states.
- At the shipbuilder, a malicious Word attachment delivered Hookedge; its operators used a hidden Edge browser to fetch tasks from webhook[.]site before switching to attacker-controlled infrastructure.
- Operators repeatedly issued commands over several days, stole credential material using an SSH private key and an NTLM challenge-response capture technique, and opened a persistent SSH tunnel into the internal network.
- The attackers deployed ld.exe, an undocumented reflective loader that decrypts a supplied file in memory; investigators did not recover the encrypted payload, so its function is unknown.
- The shipbuilder intrusion included activity from July 24 through at least July 31, 2026; the same loader hash and launcher were observed on the host weeks later.
- Symantec advised organizations finding Hookedge indicators to treat intrusions as potentially ongoing and investigate for credential theft and tunneling, not just the backdoor.
Article Details
- Attack Vectors
- A malicious macro-enabled Word document delivered as an email attachment dropped the Hookedge infection chain.
- Hookedge used a hidden, off-screen Microsoft Edge instance to retrieve tasks and payloads through webhook.site.
- A later Hookedge component fetched tasks and files from attacker-operated IP address 185.82.218[.]119 and used the same server for tasking and exfiltration.
- Operators placed an SSH private key on the compromised host and used it to establish a persistent reverse SSH tunnel into the shipbuilder's internal network.
- A PowerShell script captured NTLM challenge-response material by forcing the host to authenticate to a listener on its loopback address.
- A previously undocumented loader, ld.exe, decrypted Events.dat in memory using a command-line key and invoked its exported ExecuteLoader function.
- Defensive Notes
- Organizations finding Hookedge indicators should treat the intrusion as potentially ongoing and investigate for credential theft and tunneling, not just the backdoor installation.
- Review for suspicious macro-enabled Word attachments, Hookedge VBS launchers, hidden Edge activity, and unusual webhook.site requests.
- Investigate outbound connections and tasking to 185.82.218[.]119, including SSH activity and transfers involving the paths or identifiers listed in the article.
- Look for unauthorized SSH private keys, persistent reverse tunnels, and unexpected ssh.exe execution.
- Investigate PowerShell activity that creates a localhost HTTP listener and captures NTLM authentication handshakes.
- Symantec Endpoint products are reported to detect and block the listed malicious files when the files are available to them.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]82[.]218[.]119 | Attacker-operated server used for Hookedge tasking, payload transfers, and exfiltration; also the endpoint of the SSH tunnel. |
| SHA256 | 063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543 | SHA-256 of a Hookedge VBS launcher identified in the article's file indicators. |
| SHA256 | 1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 2fceca3460a35eea2b21c47d73c27c27edae95d2ae29ffb4ec2222d1a223b4bd | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | 68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e | SHA-256 of a Hookedge VBS launcher identified in the article's file indicators. |
| SHA256 | c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40 | SHA-256 of a Hookedge VBS launcher identified in the article's file indicators. |
| SHA256 | e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb72 | SHA-256 of a Hookedge dropper identified in the article's file indicators. |
| SHA256 | f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff | SHA-256 of ld.exe, the reflective loader deployed by the operators. |
| URL | hxxps[:]//webhook[.]site/53379b62-8020-41cf-af57-effa6e1e8506 | Specific webhook.site resource identified in Hookedge tasking and callback activity. |
| URL | hxxps[:]//webhook[.]site/5b73dc69-d765-4440-a4d2-e9eb33283eb9 | Specific webhook.site resource identified as the command-and-control session for task retrieval and output uploads. |
| URL | hxxps[:]//webhook[.]site/890efd8d-6e9e-428a-bcf9-987745d71000 | Specific webhook.site resource used by Hookedge to fetch tasks and return their output. |
| URL | hxxps[:]//webhook[.]site/ca3c058e-3c88-449b-8299-822cd5d5e17c | Specific webhook.site resource listed as a Hookedge network indicator. |
| URL | hxxps[:]//webhook[.]site/d828b9fc-5435-4b1c-881f-d6350c11d0b6 | Specific webhook.site resource listed as a Hookedge network indicator. |
MITRE ATT&CK
T1021.004 · SSHThe operators used OpenSSH to connect from the compromised host to their server and establish a persistent reverse tunnel.T1027 · Obfuscated Files or InformationThe document's macro split VBA source and strings into fragments joined at runtime to hinder static scanning.T1041 · Exfiltration Over C2 ChannelHookedge uploaded the output of executed tasks to its webhook.site endpoint and later to the attacker-operated server.T1059.001 · PowerShellA PowerShell script created a localhost listener and captured NTLM authentication handshakes.T1059.003 · Windows Command ShellBatch scripts launched the hidden browser, executed downloaded tasks, and handled task output.T1059.005 · Visual BasicThe malicious Word document used an obfuscated VBA macro to drop files and initiate the infection chain.T1059.006 · PythonThe operators ran reconnaissance and system commands through downloaded batch tasks.T1071.001 · Web ProtocolsHookedge used HTTP and HTTPS requests to retrieve tasks and send their output through webhook.site and the attacker-operated server.T1082 · System Information DiscoveryThe attackers queried system information, IP configuration, processes, installed patches, and host directories.T1087 · Account DiscoveryOperators ran whoami, whoami /all, and net group commands to inspect account and group information.T1105 · Ingress Tool TransferHookedge fetched task content and files from webhook.site and later from the attacker-operated IP address.T1110.003 · Password SprayingThe PowerShell listener captured NTLMv2 challenge-response pairs for possible offline password cracking, as described in the article.T1552.004 · Private KeysOperators placed an SSH private key on the compromised host and used it to authenticate to their server.T1566.001 · Spearphishing AttachmentThe Hookedge infection began with a malicious macro-enabled Word document received as an email attachment.
Threat Actors
Malware
Products
Tools
ld.exeThe attackers deployed a previously undocumented loader, ld.exe, which decrypts its payload and runs it in memory. The encrypted payload will not fire without a key supplied only at runtime. OpenSSHC:\Windows\System32\OpenSSH\ssh.exe -i C:\ProgramData\Adobe\id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL -o PubkeyAcceptedKeyTypes=+ssh-rsa -o HostKeyAlgorithms=+ssh-rsa -p 80
Industries
Defense manufacturingNATO member states and three distinct sectors of national security relevance: law enforcement, defense manufacturing and shipbuilding. That breadth, combined with the timing identified in Recorded Future's report,Law enforcementBlizzard), a Russian espionage group, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines.Shipbuildingand three distinct sectors of national security relevance: law enforcement, defense manufacturing and shipbuilding. That breadth, combined with the timing identified in Recorded Future's report, is consistent with a