APT28 Breaches NATO Naval Shipbuilder and Defense Firms With New Reflective Loader

Russian APT28 Dwells for Months in NATO Shipbuilder and Defense Firms

The Russia-linked state-sponsored threat actor tracked as APT28 (also known as BlueDelta, Fancy Bear, and Forest Blizzard) breached a naval shipbuilder, a manufacturer of military aircraft engines, and a law enforcement agency across two NATO member states, according to a new report from the Symantec Threat Hunter Team, a unit of Broadcom. Symantec tracks the activity cluster under the codename Swallowtail and says the intrusions combined a recently documented backdoor called HOOKEDGE with a previously undocumented in-memory loader, internally named ld.exe, that decrypts and executes a payload using a key supplied at runtime. The campaign was first reported jointly by The Hacker News and The Record on October 20, 2026. Symantec did not name the two affected countries, saying only that the victims were located in Europe.

Incident Details

How the Intrusion Unfolded

At the naval shipbuilder, an employee opened a malicious Word attachment on July 24, 2026, triggering the initial HOOKEDGE infection. Symantec says operators returned to the compromised host repeatedly over the course of a week in what "appeared to be hands-on-keyboard activity," stealing credential material through two separate techniques, opening a persistent SSH tunnel into the organization's internal network, and ultimately deploying the new reflective loader. The intrusion persisted for at least two months, and Symantec noted that the same ld.exe hash and a generic VBS launcher were still present on the host as late as late August 2026 — though researchers cautioned that this alone did not confirm continued operator access.

HOOKEDGE: A Familiar Backdoor With a New Target List

HOOKEDGE is not a new discovery. Recorded Future's Insikt Group, which tracks APT28 as BlueDelta, first publicly documented the backdoor in late August 2026 in connection with an espionage campaign against government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026. Symantec's report confirms HOOKEDGE shares significant code and tradecraft overlap with HEADLACE, a modular Windows implant APT28 has used against diplomatic targets since April 2023. HOOKEDGE itself is a barebones Windows batch-script implant, delivered via macro-enabled Word documents, capable of receiving attacker-issued commands and returning execution results. In this campaign, HOOKEDGE initially used the legitimate service webhook.site for tasking and result collection — routed through a hidden Microsoft Edge browser process — before the operators pivoted to dedicated infrastructure at 185.82.218.119.

The New Reflective Loader (ld.exe)

Beyond HOOKEDGE, Symantec documented a previously unseen reflective loader, saved to disk as ld.exe. The tool takes an encrypted file and a decryption key as command-line arguments, then decrypts and runs the resulting payload entirely in memory — leaving little forensic trace once execution completes. Symantec was not able to recover the encrypted payload itself, so the loader's ultimate second-stage functionality remains unknown.

Follow-On Activity

Once inside the shipbuilder's network, the operators layered in additional tradecraft:

• An outbound SSH reverse tunnel to 185.82.218.119, using flags consistent with establishing a dynamic, SOCKS-style forward (-R, -N, -f) that let the operators pivot into the internal network without an interactive shell.
• A PowerShell-based technique designed to coerce and capture local NTLM authentication exchanges, a common precursor to offline credential cracking or relay attacks.
• Credential theft via two separate techniques, consistent with APT28's established pattern of harvesting stored and in-transit authentication material.

Impact Assessment

Recommendations

For Defense-Sector IT and Security Teams

• Block or tightly monitor outbound traffic to webhook.site and similar webhook-relay services from endpoints that have no legitimate business reason to reach them.
• Hunt for the indicator 185.82.218.119 in proxy, firewall, and DNS logs, along with any file named ld.exe that accepts an encrypted-file path and decryption key as command-line arguments.
• Audit for unexpected outbound SSH sessions using reverse/dynamic port-forward flags (-R, -N, -f), particularly from servers and workstations that do not normally initiate SSH connections.
• Monitor for PowerShell activity that coerces NTLM authentication (e.g., forced SMB/WebDAV connections to attacker-controlled listeners) and enforce SMB signing plus NTLM relay mitigations where feasible.

For Email and Endpoint Defense

• Treat macro-enabled Word attachments from unsolicited or external senders as high risk; disable macros by default org-wide where operationally possible.
• Deploy detections for HEADLACE/HOOKEDGE tradecraft patterns, since the two implants share significant code overlap — detection rules built for one family may partially cover the other.
• Retain endpoint telemetry for at least 90 days; this campaign's documented dwell time exceeded two months, well past typical short-retention log windows.

For Organizations in NATO Defense Supply Chains

• Assume targeting if your organization supplies naval, aerospace, or defense-adjacent components, even as a subcontractor — APT28 has repeatedly targeted logistics and supply-chain firms supporting Ukraine-related efforts since 2022.
• Share IOCs (the C2 IP, ld.exe hash where available, and HOOKEDGE detection logic) through sector-specific ISACs and national CERTs promptly.
• Review third-party and vendor remote-access paths, since hands-on-keyboard activity and SSH tunneling suggest the operators were working to expand access beyond the initial foothold.

Key Takeaways

1. APT28 (BlueDelta/Fancy Bear/Forest Blizzard) breached a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency across two NATO member states, per Symantec's Threat Hunter Team.
2. The intrusion began July 24, 2026 via a malicious Word attachment and persisted for at least two months, including hands-on-keyboard activity against the shipbuilder.
3. The primary backdoor, HOOKEDGE, was first documented by Recorded Future's Insikt Group in August 2026 and shares code overlap with the older HEADLACE implant.
4. A previously undocumented reflective loader (ld.exe) was deployed to decrypt and run payloads in memory, but the actual second-stage payload was never recovered.
5. Operators used SSH tunneling to 185.82.218.119 and a PowerShell NTLM-capture technique to expand access and harvest credentials after initial compromise.
6. The campaign fits a sustained, multi-year pattern of GRU Unit 26165 operations against Western defense, logistics, and technology organizations tied to NATO and support for Ukraine.

Sources

• Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader — The Hacker News
• Defense contractors in two NATO allies hacked in recent Russia-linked campaign — The Record
• Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries — Symantec (Broadcom)