Loading story…
Russia-linked espionage group APT28, also known as Swallowtail and Fancy Bear, targeted a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two unnamed European NATO countries, according to Symantec. At the shipbuilder, an employee opened a malicious Microsoft Word email attachment, initiating an intrusion on July 24, 2026. The attackers deployed the Hookedge backdoor, conducted network reconnaissance and attempted credential theft. Related activity was observed through September 24, but researchers could not establish uninterrupted access or successful theft of sensitive information.
Hookedge initially used webhook.site for tasking and result collection through a hidden Microsoft Edge browser, then switched to attacker-controlled infrastructure at 185.82.218.119. Follow-on activity included an outbound SSH reverse tunnel and a PowerShell technique designed to capture local NTLM authentication exchanges. The attackers also deployed a previously undocumented reflective loader, ld.exe, designed to decrypt and execute a payload in memory; the encrypted payload was not recovered, leaving its ultimate functionality unknown. Researchers assessed that the apparently ongoing campaign supported Russian intelligence collection against European government and defense organizations. Defenders should investigate these indicators alongside unexpected SSH tunnels, hidden browser activity and suspicious Office attachment execution.
TTPs, infrastructure, and targeting history in one profile.
15 events from the most recent confirmed update back to the earliest known activity.
Reporting disclosed attacks against a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency in two unnamed NATO countries. News accounts attributed the campaign to APT28/Swallowtail, while the supplied technical report did not identify a responsible actor; successful theft of sensitive information was not established.
A net user command was the final distinct operator command visible in the available intrusion data.
The attackers executed a PowerShell script that created a loopback HTTP listener and induced local authentication to capture NTLM challenge-response material. The evidence did not establish successful password cracking or NTLM relay.
Initial tasks tested access to external services and collected proxy settings, logged-on sessions, network configuration, system information, running processes, and directory listings.
The VBS launcher was observed again on September 24. Researchers could not determine whether this represented renewed operator activity or continued scheduled execution.
The same ld.exe hash and a generic VBS launcher remained present in late August. Their presence alone did not establish renewed operator activity or uninterrupted access.
Recorded Future's Insikt Group published its first documentation of APT28's use of HOOKEDGE in late August, describing the earlier espionage campaign against government and diplomatic organizations.
The attackers downloaded ld.exe and Events.dat and executed the loader with a runtime decryption key. The loader decrypted content in memory and invoked ExecuteLoader, but Events.dat was not recovered, leaving the payload's purpose unknown.
The attackers staged ld.exe on the compromised host during the afternoon before its July 31 download and execution activity.
Beaconing to the same command-and-control session continued through July 29 and into July 31. No additional distinct commands were visible in the intervening telemetry.
The attackers collected system information, running processes, and installed hotfix details. They later terminated ssh.exe, ending the observed tunnel.
The operators downloaded an attacker-supplied SSH private key and used Windows OpenSSH to establish a reverse dynamic tunnel to 185.82.218.119 over port 80. Subsequent internal DNS lookups and ping tests demonstrated reconnaissance, not confirmed lateral compromise.
A renamed launcher appeared alongside an upgraded batch script that retrieved tasks directly from 185.82.218.119 over HTTPS. Seven tasks executed within approximately 30 seconds, which researchers assessed as consistent with interactive operator activity.
A malicious Word document was opened from the Outlook attachment cache at an unnamed naval shipbuilder. Its obfuscated macro installed HOOKEDGE components that used a hidden Microsoft Edge window and webhook.site for command delivery and output collection.
An espionage campaign used HOOKEDGE against government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and early April 2026, according to findings later published by Recorded Future's Insikt Group.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
12 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcesh3llc0d3.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcesecurity.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian state-linked operators used the **HOOKEDGE** Windows backdoor in spearphishing campaigns against diplomatic, government, and defense-related organizations in Romania, Spain, and Turkey. Malicious emails carried macro-enabled Microsoft Word attachments whose hidden scripts deployed a multistage installer after recipients enabled content; the malware then created scheduled tasks for persistence. HOOKEDGE launches concealed Microsoft Edge instances to poll attacker staging infrastructure, including `webhook.site`, retrieve commands, and exfiltrate collected results over HTTPS through separate hidden browser sessions. Recorded Future attributed the activity to the GRU-associated BlueDelta/**APT28** group with moderate confidence, assessing HOOKEDGE as an evolution of **HEADLACE**; operators also varied lures, VBA obfuscation, execution methods, and beacon intervals—including a 61-minute delay—to complicate detection and sandbox analysis while removing temporary artifacts.
Sep 9, 2026
A joint advisory from CISA, NSA, FBI and allied agencies warns that Russia’s GRU Unit 26165, known as **APT28, Fancy Bear and Forest Blizzard**, has conducted cyberespionage against dozens of Western government and private-sector organizations supporting aid to Ukraine since 2022. Targets include air, sea and rail transportation providers, logistics companies and related technology services. Operators gain access through password spraying, credential-harvesting and malware-delivery spearphishing, and exploitation of internet-facing infrastructure, including VPNs. Reported exploited vulnerabilities include Outlook’s NTLM credential leak (**CVE-2023-23397**), several Roundcube flaws and WinRAR’s **CVE-2023-38831**. Follow-on reporting also identifies exploitation of **CVE-2023-20273**. After compromise, operators steal credentials, conduct Active Directory reconnaissance, move laterally using Impacket, PsExec and RDP, and abuse Microsoft Exchange mailbox permissions for sustained email collection. They use legitimate utilities alongside malware such as **HEADLACE and MASEPIE**, clear event logs, and exfiltrate data through OpenSSH and email interfaces. The advisory links the campaign to targeting of more than **10,000 internet-connected cameras**, concentrated in Ukraine and neighboring countries, to monitor aid movements; that figure represents targeted cameras, not confirmed compromises. Defenders should prioritize patching exposed services, strong authentication, privileged-access restrictions and segmentation, while hunting for abnormal mailbox permissions, credential theft, lateral movement and log clearing across endpoint, cloud and network telemetry. Persistent access could enable future disruption, but the reporting does not establish confirmed sabotage.
May 27, 2025
Russia-linked APT28, also known as Swallowtail, Pawn Storm and Fancy Bear, reportedly deployed the newly identified Prismex malware toolkit in a cyberespionage campaign against military and humanitarian supply chains supporting Ukraine and its allies across Central and Eastern Europe. Prismex combines a dropper, loader and staging tool based on the open-source Covenant framework, using fileless execution, legitimate cloud services and advanced steganography to evade defenses. Trend Micro researchers assess that the toolkit represents a strategic expansion of the group's older NotDoor malware network. Reported access methods include exploitation of Microsoft Office bypass vulnerability **CVE-2026-21509** and Windows vulnerability **CVE-2026-21513**. APT28 also reportedly exploited **CVE-2026-21513** in MSHTML before disclosure and patch availability to target diplomatic and defense-aligned organizations. Spear-phishing attachments containing malicious HTML reportedly triggered execution during document opening or previewing without requiring macros, followed by in-memory shellcode and loaders, HTTPS payload retrieval, persistence and encrypted command-and-control traffic. MSHTML remains reachable through Windows document-rendering and preview functionality even when Internet Explorer is not used. Defenders should prioritize the relevant Microsoft security updates, restrict previews of untrusted documents, monitor anomalous document-process and memory activity, and limit unnecessary outbound connections.
Mar 30, 2026