APT28 Deploys HOOKEDGE Backdoor and Undocumented Reflective Loader Against NATO Defense Contractors

Date: October 22, 2026

Symantec's Threat Hunter Team disclosed on October 20 that APT28, the GRU-linked group it tracks as Swallowtail, ran an approximately two-month espionage campaign against three organizations across two unnamed European NATO member states [5][11]. The confirmed victims: a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency [6][9]. Activity spanned July 24 through at least September 24, 2026 [5][8]. At the shipbuilder, operators maintained hands-on-keyboard access for approximately four to five days and deployed two credential theft techniques, a persistent reverse SSH tunnel, and a previously undocumented reflective loader [1][9]. The full scope of exfiltrated data remains unconfirmed [3][10].

The target set is consistent with Russian intelligence collection priorities: ship designs and production data, propulsion technology, and law enforcement investigative records [5][7]. Dick O'Brien, principal intelligence analyst at Symantec, told CyberScoop that the hands-on-keyboard activity "is essentially confirmation that the organization is a genuine target for the operators, not an accidental infection" [9].

Background: APT28 and HOOKEDGE Lineage

APT28 (also tracked as Fancy Bear, Forest Blizzard, and BlueDelta) is attributed by the U.S. government to GRU Military Unit 26165, Russia's military intelligence directorate [5][15]. The group has operated since at least 2004 and maintains sustained targeting of government, defense, logistics, and technology entities connected to NATO and Ukraine[15].

Recorded Future's Insikt Group first publicly documented HOOKEDGE in late August 2026, linking it to a campaign against government and diplomatic organizations in Romania, Spain, and Turkiye between September 2025 and early April 2026 [14]. Insikt Group attributed the HOOKEDGE campaigns to BlueDelta (APT28) with moderate confidence [14]. Recorded Future described HOOKEDGE as a direct evolutionary successor to HEADLACE, a modular Windows backdoor APT28 has used against diplomatic targets since at least 2023 [14]. The evolutionary assessment rests on significant code and tradecraft overlap, consistent infrastructure patterns, and shared JavaScript variable naming and base64 encoding patterns [14].

HOOKEDGE retains HEADLACE's core architecture of abusing legitimate webhook services for C2, but has undergone continuous refinement to evade automated sandbox environments [14]. The variants Symantec observed in July 2026 at the naval shipbuilder abandoned webhook.site entirely in favor of dedicated attacker-controlled infrastructure [1][4].

Initial Access: Macro-Enabled Word Document via Spear-Phishing

The first confirmed infection occurred on July 24, 2026, when a shipbuilder employee opened a malicious Microsoft Word document directly from the Outlook attachment cache [4][5][16]. The document contained an obfuscated macro that split code into small fragments to bypass static antivirus scanning [7]. On execution, the macro wrote several files to the user's profile directory and started the HOOKEDGE infection chain [16].

HOOKEDGE is a Windows batch script backdoor capable of accepting attacker-issued commands and returning execution results [1][8]. The backdoor launched Microsoft Edge in a one-pixel window positioned off-screen, rendering it invisible to the user [5][7]. This hidden browser instance fetched tasking from webhook.site and saved results to disk [7][16]. The technique abuses a legitimate browser process and a legitimate web service simultaneously, blending malicious traffic with normal web activity.

The first tasking commands gathered basic host information and tested connectivity to common cloud services including dl.dropboxusercontent.com, accounts.google.com, and mega.nz [11]. These checks likely served as network profiling to determine what exfiltration channels were available.

C2 Infrastructure Transition

Original HOOKEDGE variants relied on webhook.site URLs for command-and-control [1][2][14]. The variants deployed at the shipbuilder in late July shifted to attacker-controlled infrastructure at 185.82.218.119 [4][8]. Symantec observed this IP used for both HTTPS C2 on port 443 (encrypted TLS for tasking and exfiltration) and as the destination for a reverse SSH tunnel on port 80 [4][8]. Running SSH over port 80 is a deliberate choice: it blends with normal HTTP egress traffic and may bypass firewall rules that restrict non-standard outbound ports [5].

Webhook.site endpoints previously associated with HOOKEDGE operations include multiple UUIDs documented in source reporting [16]. The pivot to dedicated infrastructure suggests the operators were prepared to invest in harder-to-takedown C2 once they confirmed a high-value target.

Credential Theft: NTLM Capture and SSH Key Planting

Symantec documented two independent credential theft techniques at the shipbuilder [1][3][12].

NTLM Challenge-Response Capture: The operators triggered authentication against a PowerShell loopback listener running on the compromised host [3][4]. This technique forces the local system to perform an NTLM authentication handshake against an attacker-controlled listener on localhost, capturing the challenge-response pair. That captured material can be relayed or cracked offline to recover plaintext credentials.

SSH Private Key Deployment: The attackers placed an attacker-controlled SSH private key on the compromised host [3][4]. Using Windows OpenSSH (ssh.exe), they initiated an outbound connection to 185.82.218.119 on port 80 and requested a reverse dynamic port forwarding session [3][4]. This tunnel provided the operators a persistent, encrypted channel from their infrastructure directly into the shipbuilder's internal network. The SSH process (ssh.exe) was terminated on July 28 [3], but VBS launcher activity associated with the broader intrusion was observed again as late as September 24 [3].

These two techniques serve distinct but complementary functions. The NTLM capture yields credentials for lateral movement within the Windows domain. The reverse SSH tunnel provides a re-entry path that does not depend on re-exploiting the initial vector or maintaining the HOOKEDGE backdoor.

Reflective Loader: ld.exe and Events.dat

After establishing the SSH tunnel, operators used curl through the session to download ld.exe, a previously undocumented reflective loader [2][13]. Alongside it, they downloaded Events.dat, an encrypted payload file [4].

ld.exe decrypts its payload and executes it entirely in memory using a cryptographic key supplied at runtime [1][2][11]. The key is never stored inside the binary or on disk. Because Symantec could not recover the runtime key, the contents of Events.dat and the loader's ultimate functionality remain unknown [2][3][4]. The encrypted payload on disk is analytically inert without the key.

This design achieves two objectives. It minimizes disk artifacts, defeating endpoint detection tools that rely on file-based scanning. It also renders the payload unrecoverable through standard forensic disk imaging, since the decryption key exists only in memory during execution.

Symantec warns that any HOOKEDGE detection should be treated as a potentially still-active intrusion rather than a resolved incident, precisely because the final-stage payload and its capabilities remain unconfirmed [3][11].

Hands-on-Keyboard Operations and Reconnaissance

Between July 24 and approximately July 28, Symantec observed the operators returning repeatedly to a single compromised host at the shipbuilder [1][9][11]. Activity included internal DNS lookups and ping tests consistent with network reconnaissance, though Symantec did not confirm lateral compromise to additional hosts [4].

O'Brien characterized this pattern as distinct from automated malware execution: "Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine" [9]. The deliberate, iterative nature of the access pattern indicates the shipbuilder was likely a priority intelligence target, not an opportunistic compromise.

IOC Table

Note: HOOKEDGE performs connectivity checks to dl.dropboxusercontent.com, accounts.google.com, and mega.nz [11]. These are legitimate services used for network profiling and should not be treated as indicators of compromise or blocked.

MITRE ATT&CK Mapping

The following techniques are directly supported by source reporting on this campaign:

Hidden Browser Execution

HOOKEDGE's use of a one-pixel, off-screen Edge window is a strong behavioral signal [5][7]. Elastic Security already catalogues a prebuilt detection rule that flags webhook.site connections under T1102 [5]. Hunt for:

• msedge.exe or edge.exe process creation events where command-line arguments include window size or position parameters below 5 pixels, or coordinates placing the window entirely off-screen [5]
• Any browser process spawned by cmd.exe, wscript.exe, or a batch file rather than a user shell [7]

Sigma rule (process_creation):
title: Hidden Browser Window Spawned by Script Interpreter
status: experimental
author: RedSheepSec
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_child:
        Image|endswith:
            - '\msedge.exe'
            - '\edge.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate automation scripts launching Edge (rare on endpoints)
level: high

Outbound SSH on Non-Standard Ports

APT28 ran ssh.exe outbound on TCP port 80 to blend with HTTP traffic [3][5][7]. Most enterprise workstations have no legitimate reason to initiate SSH connections, especially on port 80.

• Alert on outbound SSH from workstations, particularly over ports 80 and 443 [7]
• Query: process_name=ssh.exe AND dest_port IN (80, 443) AND src_type=workstation
• Look for ssh.exe command lines containing -R (reverse tunnel) or -D (dynamic port forwarding) flags [3]

NTLM Loopback Authentication

The PowerShell loopback listener forces the machine to authenticate to itself, generating an NTLM challenge-response pair [3][4]. This produces anomalous Windows Security event logs.

• Monitor for NTLM authentication events (Event ID 4624, logon type 3) where the source and destination are the same host [3]
• Watch for local HTTP listeners (System.Net.HttpListener in PowerShell) that trigger NTLM logins to 127.0.0.1 or localhost [7]

Reflective Loader Artifacts

ld.exe is designed to leave minimal disk artifacts, but the initial download and Events.dat are written before execution [4]. Hunt for:

• Files named ld.exe or Events.dat in user profile directories
• curl.exe invocations downloading executables through an SSH session
• Process execution of unknown binaries with command-line arguments that resemble decryption keys (long hex or base64 strings)

webhook.site Connections

• Block or alert on any connection to webhook.site from endpoints [5][8]
• Query DNS logs: query IN ("webhook.site", "*.webhook.site")

Analysis

This campaign reflects a deliberate, multi-target collection operation rather than opportunistic compromise. The target selection spans three distinct sectors (shipbuilding, aerospace propulsion, law enforcement), but all three hold material directly relevant to a military intelligence service assessing NATO defense production capacity and law enforcement activity [7][9].

The tooling progression reflects meaningful operational changes. HOOKEDGE's evolution from webhook.site-dependent C2 to dedicated infrastructure at 185.82.218.119 indicates APT28 is actively hardening its initial access tooling against takedown and detection [1][4]. The reflective loader adds a layer of analytical resistance that prior APT28 tooling (HEADLACE, for example) did not possess. The runtime-key design means even full disk forensics cannot recover the final payload without memory capture at the right moment [2][3].

The CISA joint advisory from May 2025 (AA25-141A) documented APT28's sustained targeting of logistics and technology entities supporting Ukraine, using living-off-the-land tradecraft and credential theft. This campaign fits that pattern but extends it into defense manufacturing, a sector that holds design data and production schedules relevant to force projection assessments.

O'Brien noted the campaign's motive was not certain but speculated it could relate to targeting nations aiding Ukraine [9]. Given APT28's documented mandate and the target profile, intelligence collection against European defense industrial base capacity is the most plausible objective.

References

[1] https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html

[2] https://dev.to/etairos/apt28-breaches-nato-naval-shipbuilder-with-hookedge-a-persistent-ssh-tunnel-and-a-new-reflective-30ep

[3] https://dev.to/anoymask/apt28-and-hookedge-deploy-credential-theft-ssh-tunnels-and-memory-loaders-at-nato-defense-4kdj

[4] https://mallory.ai/stories/01a1590e-3483-7b55-828d-2d134f4235bd

[5] https://www.techtimes.com/articles/329320/20261021/russia-weaponized-microsoft-edge-breach-nato-naval-shipbuilder-two-month-espionage-campaign.htm

[6] https://www.scworld.com/brief/russian-hackers-target-european-defense-organizations-in-espionage-campaign

[7] https://securityonline.info/apt28-hookedge-backdoor-nato/

[8] https://cypro.co.uk/insights/cyber-bulletins/apt28-nato-campaign-hits-defence-contractors/

[9] https://cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/

[10] https://web.matrixnews.in/news/gxlr6rmake4ng/russia-linked-hackers-targeted-defense-firms-in-two-nato-countries

[11] https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets

[12] https://radar.offseq.com/threat/swallowtail-russian-espionage-group-targets-defense-firms-in-two-nato-countries-9ab906a8feaa16e4

[13] https://the420.in/apt28-nato-naval-shipbuilder-reflective-loader-attack/

[14] https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge

[15] https://threatintelreport.com/articles/threat-actor-profile-apt28/

[16] https://www.cryptika.com/apt28-hackers-open-secret-ssh-tunnel-into-nato-countrys-naval-shipbuilder-network/

Event Timeline

Entity Relationships

Diamond Model

Hunt Guide: APT28 HOOKEDGE Backdoor and Reflective Loader Campaign Against NATO Defense Contractors

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If APT28 (Swallowtail/Fancy Bear/Forest Blizzard) is operating against our environment using the HOOKEDGE infection chain, we expect to observe outbound connections to 185.82.218.119 or webhook.site, ssh.exe spawned on workstations with reverse tunnel flags over ports 80/443, browser processes (msedge.exe) spawned by script interpreters (cmd.exe, wscript.exe) with sub-pixel window parameters, NTLM loopback authentication events, and the presence of files named ld.exe and Events.dat in user profile directories, visible in Sysmon process creation logs, Windows Security authentication logs, DNS logs, and network connection metadata.

Intelligence Summary: Symantec disclosed on October 20, 2026 that APT28 (GRU Military Unit 26165) conducted an approximately two-month espionage campaign (July 24 through at least September 24, 2026) against a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency across two European NATO member states. The operators deployed the HOOKEDGE batch-script backdoor via spear-phishing, transitioned C2 from webhook.site to dedicated infrastructure at 185.82.218.119, performed NTLM credential capture and SSH key planting for persistent reverse tunneling, and introduced a previously undocumented reflective loader (ld.exe) that decrypts and executes payloads entirely in memory using a runtime key, rendering the final-stage payload unrecoverable through disk forensics. Symantec warns that any HOOKEDGE detection should be treated as a potentially still-active intrusion because the final-stage payload capabilities remain unconfirmed.

Confidence: Moderate | Priority: Critical

Scope

• Networks: All enterprise Windows workstation and server segments, with priority on segments hosting defense-related engineering, procurement, or law enforcement systems. Include DMZ and VPN egress points where outbound SSH or webhook.site traffic would traverse.
• Timeframe: Retrospective hunt window: July 1, 2026 through present. The campaign's confirmed activity spans July 24 through at least September 24, 2026, with VBS launcher activity indicating persistence beyond the initial SSH tunnel termination. Forward-looking detection should remain active indefinitely.
• Priority Systems: Windows workstations in engineering, procurement, executive, and legal/law enforcement divisions. Systems with Outlook usage and macro-enabled Office installations. Jump hosts and systems with OpenSSH client installed. Domain controllers (for NTLM relay attack impact assessment).

MITRE ATT&CK Techniques

T1566.001: Phishing: Spearphishing Attachment (Initial Access) [P2]

APT28 delivered a macro-enabled Microsoft Word document via email. The victim opened the attachment directly from the Outlook attachment cache on July 24, 2026, triggering the HOOKEDGE infection chain.

Splunk SPL:

index=sysmon EventCode=1 (ParentImage="*\\OUTLOOK.EXE" OR ParentImage="*\\outlook.exe") (Image="*\\WINWORD.EXE" OR Image="*\\winword.exe")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName ParentImage Image CommandLine User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

process.parent.executable:*\\OUTLOOK.EXE AND process.executable:*\\WINWORD.EXE

Sigma Rule:

title: Word Document Launched from Outlook Attachment Cache
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\\OUTLOOK.EXE'
        Image|endswith: '\\WINWORD.EXE'
    filter_commandline:
        CommandLine|contains:
            - 'Content.Outlook'
    condition: selection and filter_commandline
falsepositives:
    - Legitimate users opening Word documents from Outlook attachments (high volume; combine with downstream detections)
level: low

This query alone generates high volume. Combine with downstream indicators such as macro execution, child processes of WINWORD.EXE (cmd.exe, wscript.exe, powershell.exe), or file writes to user profile directories. Filter by known-good attachment paths if needed.

T1204.002: User Execution: Malicious File (Execution) [P2]

The victim user executed the malicious macro-enabled Word document, which wrote files to the user profile directory and initiated the HOOKEDGE backdoor chain.

Splunk SPL:

index=sysmon EventCode=1 ParentImage="*\\WINWORD.EXE" (Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\powershell.exe")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName ParentImage Image CommandLine User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

process.parent.executable:*\\WINWORD.EXE AND (process.executable:*\\cmd.exe OR process.executable:*\\wscript.exe OR process.executable:*\\cscript.exe OR process.executable:*\\powershell.exe)

Sigma Rule:

title: Suspicious Child Process of Microsoft Word
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\\WINWORD.EXE'
    selection_child:
        Image|endswith:
            - '\\cmd.exe'
            - '\\wscript.exe'
            - '\\cscript.exe'
            - '\\powershell.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate macro-based automation (should be rare on standard workstations)
level: high

This is a core detection for macro-based initial access. Tune false positives by excluding known-good macros. High-confidence when combined with file creation of .vbs or .bat files in user profile directories.

T1059.003: Command and Scripting Interpreter: Windows Command Shell (Execution) [P1]

HOOKEDGE is a Windows batch-script backdoor executed through cmd.exe. It accepts attacker-issued commands and returns execution results via C2.

Splunk SPL:

index=sysmon EventCode=1 Image="*\\cmd.exe" (CommandLine="*webhook.site*" OR CommandLine="*185.82.218.119*" OR CommandLine="*msedge*" OR CommandLine="*edge.exe*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName Image CommandLine ParentImage User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

process.executable:*\\cmd.exe AND (process.command_line:*webhook.site* OR process.command_line:*185.82.218.119* OR process.command_line:*msedge* OR process.command_line:*edge.exe*)

Sigma Rule:

title: CMD Execution Referencing HOOKEDGE C2 Indicators
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\cmd.exe'
    filter_c2:
        CommandLine|contains:
            - 'webhook.site'
            - '185.82.218.119'
    condition: selection and filter_c2
falsepositives:
    - Very unlikely in production environments
level: critical

Direct IOC match in command-line arguments. Any hit is high confidence and warrants immediate investigation.

T1059.001: Command and Scripting Interpreter: PowerShell (Execution) [P2]

APT28 used a PowerShell loopback listener (System.Net.HttpListener) to force NTLM authentication on the compromised host, capturing the NTLM challenge-response pair for offline cracking or relay.

Splunk SPL:

index=powershell EventCode=4104 (ScriptBlockText="*HttpListener*" OR ScriptBlockText="*System.Net.HttpListener*" OR ScriptBlockText="*NTLM*" OR ScriptBlockText="*127.0.0.1*" OR ScriptBlockText="*localhost*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(ScriptBlockText) as scripts by ComputerName UserID
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

event.code:4104 AND powershell.file.script_block_text:(*HttpListener* OR *System.Net.HttpListener* OR *NTLM*)

Sigma Rule:

title: PowerShell HTTP Listener for NTLM Credential Capture
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: ps_script
    product: windows
detection:
    selection:
        ScriptBlockText|contains:
            - 'System.Net.HttpListener'
            - 'HttpListener'
    filter_ntlm:
        ScriptBlockText|contains:
            - 'NTLM'
            - '127.0.0.1'
            - 'localhost'
    condition: selection or (selection and filter_ntlm)
falsepositives:
    - Legitimate PowerShell-based web servers (rare on endpoints)
level: high

The NTLM loopback capture technique is unusual on standard workstations. Any PowerShell HttpListener creation on a non-server endpoint is suspicious. Cross-reference with Windows Security Event ID 4624 logon type 3 where source and destination IP are the same host.

T1564.003: Hide Artifacts: Hidden Window (Defense Evasion) [P2]

HOOKEDGE launched Microsoft Edge (msedge.exe) in a one-pixel window positioned off-screen, rendering the browser instance invisible to the user while it fetched C2 tasking from webhook.site or attacker-controlled infrastructure.

Splunk SPL:

index=sysmon EventCode=1 (Image="*\\msedge.exe" OR Image="*\\edge.exe") (ParentImage="*\\cmd.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName Image ParentImage CommandLine User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

(process.executable:*\\msedge.exe OR process.executable:*\\edge.exe) AND (process.parent.executable:*\\cmd.exe OR process.parent.executable:*\\wscript.exe OR process.parent.executable:*\\cscript.exe)

Sigma Rule:

title: Hidden Browser Window Spawned by Script Interpreter
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\cmd.exe'
            - '\\wscript.exe'
            - '\\cscript.exe'
    selection_child:
        Image|endswith:
            - '\\msedge.exe'
            - '\\edge.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate automation scripts launching Edge (rare on endpoints)
level: high

Browser processes spawned by cmd.exe, wscript.exe, or cscript.exe are unusual on standard workstations. If command-line arguments include window size parameters below 5 pixels or coordinates placing the window off-screen, confidence increases to near-certain malicious activity.

T1102: Web Service (Command and Control) [P1]

Original HOOKEDGE variants used webhook.site URLs for C2 tasking and result exfiltration. The legitimate web service was abused to blend malicious traffic with normal web activity.

Splunk SPL:

index=corelight sourcetype=corelight_dns query="*webhook.site*"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h query answers
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

dns.question.name:*webhook.site*

Sigma Rule:

title: DNS Query to webhook.site C2 Service
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: dns
detection:
    selection:
        query|contains: 'webhook.site'
    condition: selection
falsepositives:
    - Developer testing of webhooks (should be rare in production enterprise environments)
level: high

webhook.site is a legitimate service, but its use from enterprise endpoints is uncommon and should be investigated. Block at proxy/firewall and alert on DNS resolution attempts. Also sweep historical DNS logs for any past resolutions.

T1572: Protocol Tunneling (Command and Control) [P1]

APT28 used Windows OpenSSH (ssh.exe) to establish a reverse dynamic port forwarding tunnel over TCP port 80 to 185.82.218.119, providing a persistent encrypted channel into the victim network that blends with normal HTTP egress traffic.

Splunk SPL:

index=sysmon EventCode=1 Image="*\\ssh.exe" (CommandLine="*-R*" OR CommandLine="*-D*" OR CommandLine="*185.82.218.119*" OR CommandLine="*root@*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName Image CommandLine ParentImage User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

process.executable:*\\ssh.exe AND (process.command_line:*-R* OR process.command_line:*-D* OR process.command_line:*185.82.218.119* OR process.command_line:*root@*)

Sigma Rule:

title: SSH Reverse Tunnel or Dynamic Port Forwarding from Workstation
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection_ssh:
        Image|endswith: '\\ssh.exe'
    selection_flags:
        CommandLine|contains:
            - ' -R '
            - ' -D '
            - ' -R"'
            - ' -D"'
    condition: selection_ssh and selection_flags
falsepositives:
    - IT administrators using SSH tunnels for legitimate remote management (should be documented)
level: high

Most enterprise workstations have no legitimate reason to initiate SSH connections, especially on port 80 or 443. Any ssh.exe execution on a workstation with -R or -D flags should be investigated immediately. Also query for ssh.exe network connections to port 80.

T1620: Reflective Code Loading (Defense Evasion) [P1]

The previously undocumented reflective loader ld.exe decrypts Events.dat and executes the payload entirely in memory using a runtime cryptographic key. The key is never stored on disk, making the payload unrecoverable through standard forensic disk imaging.

Splunk SPL:

(index=sysmon EventCode=1 (Image="*\\ld.exe" OR CommandLine="*ld.exe*" OR CommandLine="*Events.dat*"))
OR
(index=sysmon EventCode=11 (TargetFilename="*\\ld.exe" OR TargetFilename="*\\Events.dat"))
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(Image) as images values(TargetFilename) as files by ComputerName User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

(process.executable:*\\ld.exe OR process.command_line:*Events.dat*) OR (file.name:(ld.exe OR Events.dat))

Sigma Rule:

title: Reflective Loader ld.exe or Encrypted Payload Events.dat Detection
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection_process:
        Image|endswith: '\\ld.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'ld.exe'
            - 'Events.dat'
    condition: selection_process or selection_cmdline
falsepositives:
    - Legitimate binaries named ld.exe are uncommon on Windows
level: critical

ld.exe is not a standard Windows binary. Any instance on a Windows endpoint warrants immediate investigation. Also hunt for curl.exe downloading executables or .dat files through SSH tunnels. The SHA-256 hash f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff can be used for direct file hash matching.

T1187: Forced Authentication (Credential Access) [P2]

APT28 operators triggered NTLM authentication against a PowerShell loopback listener running on localhost, capturing the NTLM challenge-response pair for offline cracking or relay. This produces anomalous Windows Security event logs with logon type 3 where source and destination are the same host.

Splunk SPL:

index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4624 Logon_Type=3
| eval src_ip=coalesce(Source_Network_Address, IpAddress)
| eval dest_ip=coalesce(dest, ComputerName)
| where src_ip="127.0.0.1" OR src_ip="::1" OR src_ip=dest_ip
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName src_ip dest_ip TargetUserName AuthenticationPackageName
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

event.code:4624 AND winlog.event_data.LogonType:3 AND (source.ip:127.0.0.1 OR source.ip:"::1")

Sigma Rule:

title: NTLM Loopback Authentication Indicating Credential Capture
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
    filter_loopback:
        IpAddress:
            - '127.0.0.1'
            - '::1'
    condition: selection and filter_loopback
falsepositives:
    - Local IIS or web development tools performing loopback NTLM (should be documented)
level: high

NTLM logon type 3 from 127.0.0.1 is abnormal on most workstations. Correlate with PowerShell ScriptBlock logs (Event ID 4104) referencing HttpListener or NTLM for high-confidence detection. False positives from local IIS testing should be baselined.

T1573: Encrypted Channel (Command and Control) [P1]

APT28 used TLS-encrypted HTTPS C2 to 185.82.218.119 on port 443 for tasking and exfiltration, and SSH over port 80 for persistent tunnel access. Both channels encrypt traffic to evade content inspection.

Splunk SPL:

index=corelight sourcetype=corelight_conn id_resp_h="185.82.218.119"
| stats count earliest(_time) as first_seen latest(_time) as last_seen sum(orig_bytes) as bytes_out sum(resp_bytes) as bytes_in by id_orig_h id_resp_h id_resp_p proto
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

destination.ip:185.82.218.119

Direct IOC sweep. Any connection to 185.82.218.119 warrants immediate investigation. Also check for SSH protocol on port 80, which is a strong behavioral indicator even without the specific IP.

T1059.005: Command and Scripting Interpreter: Visual Basic (Execution) [P1]

A VBS launcher (53379b62-8020-41cf-af57-effa6e1e8506.vbs) was dropped via C2 and observed executing as late as September 24, 2026, nearly two months after the SSH tunnel was terminated, indicating an additional persistence mechanism.

Splunk SPL:

index=sysmon (EventCode=1 OR EventCode=11) (CommandLine="*53379b62-8020-41cf-af57-effa6e1e8506*" OR TargetFilename="*53379b62-8020-41cf-af57-effa6e1e8506*" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName EventCode Image CommandLine TargetFilename User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Elastic KQL:

process.command_line:*53379b62-8020-41cf-af57-effa6e1e8506* OR file.name:*53379b62-8020-41cf-af57-effa6e1e8506*

Sigma Rule:

title: HOOKEDGE VBS Launcher UUID Filename
status: experimental
author: RedSheepSec
date: 2026/10/22
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '53379b62-8020-41cf-af57-effa6e1e8506'
    condition: selection
falsepositives:
    - None expected
level: critical

The UUID-based filename is a direct IOC. Also broadly hunt for .vbs files with UUID-pattern filenames in user profile directories, as APT28 may use different UUIDs across targets.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=corelight (sourcetype=corelight_conn OR sourcetype=corelight_dns OR sourcetype=corelight_http OR sourcetype=corelight_ssl) (id_resp_h="185.82.218.119" OR id_orig_h="185.82.218.119" OR answers="185.82.218.119")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by sourcetype id_orig_h id_resp_h id_resp_p
| convert ctime(first_seen) ctime(last_seen)
| sort - count

index=corelight sourcetype=corelight_dns query="*webhook.site"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h query answers
| convert ctime(first_seen) ctime(last_seen)
| sort - count

index=sysmon (EventCode=1 Image="*\\ld.exe") OR (EventCode=11 TargetFilename="*\\ld.exe")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName EventCode Image TargetFilename CommandLine User
| convert ctime(first_seen) ctime(last_seen)

index=sysmon EventCode=11 TargetFilename="*\\Events.dat"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName TargetFilename Image User
| convert ctime(first_seen) ctime(last_seen)

index=sysmon (EventCode=1 OR EventCode=11) (CommandLine="*53379b62-8020-41cf-af57-effa6e1e8506*" OR TargetFilename="*53379b62-8020-41cf-af57-effa6e1e8506*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName EventCode Image TargetFilename CommandLine User
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_http (uri="*890efd8d-6e9e-428a-bcf9-987745d71000*" OR host="webhook.site")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h host uri
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_http (uri="*53379b62-8020-41cf-af57-effa6e1e8506*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h host uri
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_http (uri="*5b73dc69-d765-4440-a4d2-e9eb33283eb9*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h host uri
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_http (uri="*d828b9fc-5435-4b1c-881f-d6350c11d0b6*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h host uri
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_http (uri="*ca3c058e-3c88-449b-8299-822cd5d5e17c*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h host uri
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_http id_resp_h="185.82.218.119" uri="*53379b62-8020-41cf-af57-effa6e1e8506*"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h id_resp_h uri
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_http id_resp_h="185.82.218.119" uri="*5b73dc69-d765-4440-a4d2-e9eb33283eb9*"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h id_resp_h uri
| convert ctime(first_seen) ctime(last_seen)

index=sysmon EventCode=1 CommandLine="*root@185.82.218.119*"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName Image CommandLine User
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_dns query="*mocky.io"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h query answers
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_dns query="*mockbin.org"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h query answers
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_dns query="*giize.com"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h query answers
| convert ctime(first_seen) ctime(last_seen)

index=sysmon (EventCode=1 CommandLine="*a.cmd*" ParentImage="*\\cmd.exe") OR (EventCode=11 TargetFilename="*\\a.cmd")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName Image CommandLine TargetFilename User
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_conn (id_resp_h="194.126.178.8" OR id_orig_h="194.126.178.8")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h id_resp_h id_resp_p
| convert ctime(first_seen) ctime(last_seen)

index=corelight sourcetype=corelight_conn (id_resp_h="207.244.71.84" OR id_orig_h="207.244.71.84")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by id_orig_h id_resp_h id_resp_p
| convert ctime(first_seen) ctime(last_seen)

index=sysmon EventCode=13 TargetObject="*\\Software\\Microsoft\\Office\\16.0\\Outlook\\Logging\\Locale*"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName TargetObject Details Image User
| convert ctime(first_seen) ctime(last_seen)

index=sysmon EventCode=13 TargetObject="*\\Software\\Microsoft\\Office\\16.0\\Outlook\\Logging\\Counter*"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName TargetObject Details Image User
| convert ctime(first_seen) ctime(last_seen)

YARA Rules

APT28_HOOKEDGE_ReflectiveLoader_ldexe: Detects the APT28 reflective loader ld.exe by SHA-256 hash and filename/string patterns associated with the HOOKEDGE campaign

rule APT28_HOOKEDGE_ReflectiveLoader_ldexe {
    meta:
        description = "Detects APT28 reflective loader ld.exe used in HOOKEDGE campaign against NATO defense contractors"
        author = "RedSheepSec"
        date = "2026-10-22"
        reference = "https://www.techtimes.com/articles/329320/20261021/russia-weaponized-microsoft-edge-breach-nato-naval-shipbuilder-two-month-espionage-campaign.htm"
        hash = "f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff"
        threat_actor = "APT28"
    strings:
        $hash = { f1 cc 91 e7 42 7a 22 02 7f 65 d3 1b be e1 9c 54 b6 02 d0 8d 7d 93 e4 74 5b 9c ea 59 fa 81 32 ff }
        $s1 = "Events.dat" ascii wide
        $s2 = "ld.exe" ascii wide
    condition:
        uint16(0) == 0x5A4D and (any of ($hash, $s1, $s2))
}

APT28_HOOKEDGE_VBSLauncher: Detects the VBS launcher file used in the HOOKEDGE campaign by UUID filename pattern

rule APT28_HOOKEDGE_VBSLauncher {
    meta:
        description = "Detects APT28 HOOKEDGE VBS launcher by UUID-pattern filename"
        author = "RedSheepSec"
        date = "2026-10-22"
        reference = "https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets"
        threat_actor = "APT28"
    strings:
        $uuid1 = "53379b62-8020-41cf-af57-effa6e1e8506" ascii wide nocase
        $uuid2 = "890efd8d-6e9e-428a-bcf9-987745d71000" ascii wide nocase
        $uuid3 = "5b73dc69-d765-4440-a4d2-e9eb33283eb9" ascii wide nocase
        $uuid4 = "d828b9fc-5435-4b1c-881f-d6350c11d0b6" ascii wide nocase
        $uuid5 = "ca3c058e-3c88-449b-8299-822cd5d5e17c" ascii wide nocase
        $c2_ip = "185.82.218.119" ascii wide
        $webhook = "webhook.site" ascii wide nocase
    condition:
        any of ($uuid*) or ($c2_ip and $webhook)
}

Suricata Rules

SID 2026101: Detects outbound connection to APT28 HOOKEDGE C2 infrastructure at 185.82.218.119

alert ip $HOME_NET any -> 185.82.218.119 any (msg:"ET TROJAN APT28 HOOKEDGE C2 Server (185.82.218.119)"; classtype:trojan-activity; sid:2026101; rev:1; metadata:created_at 2026_10_22, updated_at 2026_10_22;)

SID 2026102: Detects SSH traffic on port 80, a technique used by APT28 to tunnel SSH through standard HTTP port

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"POLICY Outbound SSH on Port 80 - Possible Protocol Tunneling"; flow:established,to_server; content:"SSH-"; depth:4; classtype:policy-violation; sid:2026102; rev:1; metadata:created_at 2026_10_22, updated_at 2026_10_22;)

SID 2026103: Detects DNS query for webhook.site, a legitimate service abused by APT28 HOOKEDGE for C2

alert dns $HOME_NET any -> any any (msg:"ET TROJAN APT28 HOOKEDGE webhook.site C2 DNS Lookup"; dns.query; content:"webhook.site"; nocase; classtype:trojan-activity; sid:2026103; rev:1; metadata:created_at 2026_10_22, updated_at 2026_10_22;)

SID 2026104: Detects TLS connection to APT28 HOOKEDGE C2 at 185.82.218.119 on port 443

alert tls $HOME_NET any -> 185.82.218.119 443 (msg:"ET TROJAN APT28 HOOKEDGE TLS C2 to 185.82.218.119:443"; flow:established,to_server; classtype:trojan-activity; sid:2026104; rev:1; metadata:created_at 2026_10_22, updated_at 2026_10_22;)

SID 2026105: Detects outbound connection to APT28 infrastructure IP 194.126.178.8 from CISA AA25-141A advisory

alert ip $HOME_NET any -> 194.126.178.8 any (msg:"ET TROJAN APT28 Infrastructure IP (194.126.178.8) per CISA AA25-141A"; classtype:trojan-activity; sid:2026105; rev:1; metadata:created_at 2026_10_22, updated_at 2026_10_22;)

Data Source Requirements

Mitigations & Recommendations

Curated baseline: APT28 / Fancy Bear; library archetype

Established mitigations (curated):

• Patch CVE-2023-23397 Outlook, CVE-2022-38028 Print Spooler, all Roundcube CVEs across the fleet.
• Block outbound NTLM authentication at perimeter (Group Policy: NTLM traffic to remote servers).
• Rotate NTLM-exposed user passwords; force MFA re-enrollment.
• Disable Print Spooler on DCs and servers that don't need it.
• Block legacy auth tenant-wide via CA policy.
• Block known APT28 C2 and exfil infrastructure (CISA / Mandiant IOCs).

Established detection guidance (curated):

• CVE-2023-23397 Outlook NTLM relay hunt: outbound NTLM auth attempts to non-corporate SMB endpoints.
• GooseEgg / CVE-2022-38028 Print Spooler exploitation hunt.
• APT28 malware hash / name hunt.
• Roundcube / webmail exploitation hunt.
• Password spray against privileged accounts via legacy auth.
• Check for outbound connections to Yahoo / Google Drive / legitimate cloud abuse (APT28 C2 technique).

Net-new from this incident:

• Block outbound connections to webhook.site at the proxy and firewall level. While webhook.site is a legitimate service, enterprise endpoint traffic to it is abnormal and directly associated with HOOKEDGE C2. Hunt historical DNS logs (index=corelight sourcetype=corelight_dns query="webhook.site") for any past resolution.
• Block 185.82.218.119 at the perimeter firewall (all ports). Add to threat intelligence blocklists and configure alerting for any historical or future connection attempts.
• Deploy the SSH tunneling detection (ssh.exe with -R or -D flags, or destination port 80/443) across all Windows endpoint monitoring. Most workstations have no legitimate SSH use; exceptions should be baselined and whitelisted.
• Configure Microsoft Office Group Policy to block macros from running in Office files from the Internet (Mark of the Web enforcement). Verify that archive extraction tools (7-Zip, WinRAR) are not stripping the Mark of the Web flag.
• Enable PowerShell ScriptBlock Logging (Event ID 4104) and Module Logging across all endpoints if not already active. This is required to detect the NTLM loopback credential capture technique.
• Deploy Sysmon EventID 3 (Network Connection) logging for ssh.exe, curl.exe, and wscript.exe to capture outbound connections from these processes to attacker infrastructure.
• Add the ld.exe SHA-256 hash (f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff) to EDR hash blocklists and YARA scanning engines.
• Deploy the Suricata rules provided in this report (SID 2026101-2026105) to detect C2 traffic patterns including SSH-over-port-80 and DNS lookups for webhook.site.
• Per Symantec's guidance, treat any HOOKEDGE detection as a potentially still-active intrusion. The unrecovered final-stage payload from ld.exe may include persistent capabilities operating independently of HOOKEDGE. Full memory capture should be prioritized over disk-only forensics on any compromised host.

Sources

• The Hacker News - Russian APT28 Breaches NATO Naval Shipbuilder
• Dev.to - APT28 Breaches NATO Naval Shipbuilder with HOOKEDGE
• Dev.to - APT28 and HOOKEDGE Deploy Credential Theft, SSH Tunnels, and Memory Loaders
• Mallory.ai - APT28 HOOKEDGE Campaign Analysis
• TechTimes - Russia Weaponized Microsoft Edge to Breach NATO Naval Shipbuilder
• SC World - Russian Hackers Target European Defense Organizations
• Security Online - APT28 HOOKEDGE Backdoor NATO
• Cypro - APT28 NATO Campaign Hits Defence Contractors
• CyberScoop - Russian Hackers APT28 Target NATO Defense Firms
• Matrix News - Russia-Linked Hackers Targeted Defense Firms in Two NATO Countries
• Security.com - Swallowtail Russia NATO Targets Threat Intelligence
• Radar OffSeq - Swallowtail Russian Espionage Group Targets Defense Firms
• The420.in - APT28 NATO Naval Shipbuilder Reflective Loader Attack
• Recorded Future - BlueDelta Targets with HOOKEDGE
• Threat Intel Report - Threat Actor Profile: APT28
• Cryptika - APT28 Hackers Open Secret SSH Tunnel into NATO Naval Shipbuilder Network
• CISA Joint Advisory AA25-141A - APT28 Sustained Targeting