APT28 Spent the Summer Inside a NATO Naval Shipbuilder
Symantec says Russia's APT28 breached a naval shipbuilder, a law enforcement agency and an aircraft-engine maker in two NATO countries, using the HOOKEDGE backdoor and a previously unseen reflective loader.
Russia’s APT28 spent the summer inside a naval shipbuilder in a NATO member state, according to new research from Symantec’s Threat Hunter Team, which tracks the group as Swallowtail. The same campaign also hit a law enforcement agency and a maker of military aircraft engines across two NATO countries; Symantec doesn’t name the countries or the victims. The intrusion started with a booby-trapped Word document in late July, and Symantec says the backdoor’s launcher was still turning up on the network as recently as September 24. The Hacker News first reported the findings.
For defenders
Symantec’s timeline: a macro-laced Word document opened from Outlook’s attachment cache on July 24 dropped HOOKEDGE, a lightweight backdoor first documented by Recorded Future in August. HOOKEDGE fetches tasks by launching a hidden, off-screen Microsoft Edge window and polling webhook[.]site, then later switched to a dedicated IP. Over the following week the operators:
- pushed an SSH private key to
C:\ProgramData\Adobe\id_rsaand opened a backgrounded tunnel to their server (SSH over port 80, host-key checking disabled); - ran a PowerShell listener on localhost:8080 and coerced the host to authenticate to it, capturing NTLM handshakes;
- on July 31, ran a previously undocumented reflective loader,
ld.exe, which decrypts a file (Events.dat) in memory with a key passed on the command line and calls an export named ExecuteLoader. Symantec didn’t recover the decrypted payload, so what it does is not known.
Whether bulk data left the network is not disclosed; Symantec says credential material was stolen and advises treating the intrusion as possibly still active. No CVEs are involved. Behaviors map to ATT&CK T1566.001 (Phishing: Spearphishing Attachment), T1102 (Web Service), T1572 (Protocol Tunneling), T1187 (Forced Authentication) and T1620 (Reflective Code Loading).
185.82.218[.]119 (HTTPS 443 tasking/exfil; SSH on 80)
hxxps://webhook[.]site/890efd8d-6e9e-428a-bcf9-987745d71000
hxxps://webhook[.]site/53379b62-8020-41cf-af57-effa6e1e8506
hxxps://webhook[.]site/5b73dc69-d765-4440-a4d2-e9eb33283eb9
hxxps://webhook[.]site/d828b9fc-5435-4b1c-881f-d6350c11d0b6
hxxps://webhook[.]site/ca3c058e-3c88-449b-8299-822cd5d5e17cld.exe loader: f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff
VBS launcher: 063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543
VBS launcher: d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40
VBS launcher: aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e
Paths: C:\ProgramData\ld.exe, C:\ProgramData\Adobe\id_rsa, Events.dat
(17 HOOKEDGE dropper hashes are in Symantec’s report)What it means for you
If you don’t work in defense, government or their supply chain, this one isn’t aimed at you. The lesson that travels is old but still true: the whole thing began with someone opening a Word attachment that asked to run macros (small programs embedded in the document). If an Office file you weren’t expecting asks you to “enable content,” don’t. And if your small business supplies a defense contractor, assume you’re interesting to people like this, because contractors often get used as a way in.
Do this now
- Block macros in Office files from the internet by policy, and alert on Word or Excel spawning wscript, cmd or a new Edge process.
- Hunt for Edge launched with tiny or off-screen window sizes, and for any outbound traffic to webhook[.]site from workstations.
- Look for ssh.exe on Windows endpoints, private keys under C:\ProgramData, and outbound SSH on non-standard ports such as 80.
- If you find HOOKEDGE, reset credentials for the affected users and host, since the NTLM capture means passwords may already be cracked offline.