- Symantec says Russia's APT28, tracked as Swallowtail, ran an intrusion of at least two months at a naval shipbuilder in a NATO member state, using the Hookedge backdoor.
- Attackers used Word, Edge, curl, PowerShell and SSH alongside their own key, loader and server. Symantec says its endpoint products will detect and block malicious files it has obtained.
- Symantec advises treating any Hookedge find as possibly ongoing and searching for credential theft and tunnelling, not just the backdoor.
A Word attachment was opened on the afternoon of July 24, 2026. Within minutes, a browser window one pixel wide, parked far off-screen, was fetching instructions from a public website. The lesson WebPulse draws from a new Symantec report is how much of this attack was built from software a company already runs.
Symantec's Threat Hunter Team reports that a Russian espionage group it calls Swallowtail went after organizations in two NATO countries. Other names for the group are APT28, Fancy Bear and Forest Blizzard. The victims included a law enforcement agency, a builder of naval ships and a maker of military aircraft engines. Symantec says all three were likely to hold material a foreign intelligence service would want.
What Symantec found at the shipbuilder
Symantec describes the shipbuilder case in the most detail. The Word document was opened from the Outlook attachment cache, which shows it arrived as an emailed attachment.
Over the following week, Symantec says, operators returned to the host repeatedly in what looked like hands-on-keyboard work. They stole credentials in two different ways and opened a persistent SSH tunnel into the internal network. They also deployed a loader no one had documented before. Symantec puts the whole intrusion at no less than two months.
How the attack worked
The document held a macro, a small program inside the file. Symantec says the macro was split into short fragments that are joined only when it runs, a trick to defeat antivirus scanning. It dropped four files, including a batch script.
That script closed any open Edge browser. It then launched a new Edge window sized to one pixel and placed off-screen. The window carried an encoded script that fetched instructions from webhook.site, a public service for testing web requests. Edge did the downloading, in place of a conventional download program.
The instructions arrived as a batch file, and its output went back to the same address. The first task was reconnaissance. It checked which outbound routes were open, including Dropbox, Google, Microsoft's login page and Mega. Symantec says this was possibly a step toward choosing where to stage payloads or send stolen data.
After a gap of about three days, a second-stage script began taking orders from a dedicated IP address instead of webhook.site. Seven tasks arrived in 30 seconds, each two to eight seconds after the last. Symantec says that pace suggests a person at a keyboard, not a timer.
The operators then placed an SSH private key in a ProgramData folder and used it to connect to their own server as root. The connection was set up as a background tunnel, giving them a route into the shipbuilder's internal network. They also ran a short PowerShell script that made the machine log in to itself. That captured an NTLM handshake, part of the Windows login process. Symantec notes an attacker can try to crack the password hash offline or relay it to another host.
On July 31 they ran ld.exe, the new loader. It decrypts a file in memory using a key typed on the command line, then runs it. Symantec did not recover the encrypted file, so its purpose is unknown.
Why familiar tools matter
This is WebPulse's interpretation, not Symantec's. Word, Edge, curl, PowerShell and SSH are all part of ordinary Windows work, and webhook.site is a legitimate service. The attackers used them to carry out the intrusion. The commands in Symantec's report include a call to the Windows OpenSSH client.
The attack was not made only of ordinary parts. It needed a macro document, dropped files, an SSH key, a root tunnel to the attackers' server and the ld.exe loader. Symantec says its endpoint products will detect and block malicious files it has obtained. The harder question is whether a team would notice odd use of normal tools. Examples are Edge running at one pixel, or a workstation opening an SSH tunnel.
Symantec makes a related point. It says the tradecraft after the first break-in goes beyond the delivery method reported publicly so far. Recorded Future's Insikt Group, which follows the same actor as BlueDelta, described Hookedge publicly in August 2026. Defenders who stopped at the backdoor would have missed the credential theft and the tunnel.
What remains unknown
The report leaves open questions. The loader's payload was not recovered. The Hacker News reports it is unclear whether any data was stolen.
Activity continued after the last operator commands. Symantec says the same loader file and launcher were still on the host in late August, and the launcher was seen again on September 24. It cannot tell whether an old scheduled task kept firing or the operators returned.
Questions to put to your security team
Symantec advises treating any Hookedge find as possibly ongoing and searching for the credential theft and tunnelling it describes. Beyond that, ask five questions.
First, can we alert when Edge starts with a tiny window placed off-screen? Second, do we see outbound connections to webhook.site, and does anyone here need them? Third, can staff open macro-enabled Word files from email? Fourth, which machines should be allowed to start outbound SSH sessions, and do we log them? Fifth, do we record PowerShell activity well enough to spot a script that makes a host authenticate to itself?
Symantec published file hashes and webhook.site addresses, including the SHA256 for ld.exe, that your team can search for today. The wider point is that the attackers leaned heavily on tools already in the environment. Defence has to watch how those tools are used, not only which files appear.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Symantec (Broadcom) Threat Hunter Team.
