APT28 Hackers Open Secret SSH Tunnel Into NATO Country’s Naval Shipbuilder Network

Russian cyberespionage group APT28 used the Hookedge backdoor to reach a naval shipbuilder’s network in a NATO member state, steal login material and set up a hidden SSH tunnel.

The intrusion lasted at least two months, according to a report by Symantec’s Threat Hunter Team. The report does not name the shipbuilder or the country.

It also describes activity against organizations in a second NATO member state, including a law enforcement agency and a maker of military aircraft engines.

APT28, also known as Fancy Bear and Forest Blizzard, is referred to as Swallowtail in Symantec’s report. Researchers from Symantec identified Hookedge activity at the three organizations.

Their findings add detail to earlier public reporting on the malware, including this report on Hookedge targeting, which described the backdoor’s use of Word documents and web services.

APT28 Hackers

At the shipbuilder, the activity began on July 24, 2026, when a malicious Word document was opened from the Outlook attachment cache. Its hidden macro wrote several files to the user’s profile and started the infection chain.

One of those files launched Hookedge, a backdoor that can fetch instructions, run commands and send back their output. The malware used a hidden Microsoft Edge window to contact webhook.site, a public web service.

The use of a familiar browser and a legitimate service could make the traffic harder to spot among normal web activity. An earlier Hookedge campaign analysis also describes how the backdoor used Edge and webhook services to receive instructions and return results.

The first commands gathered basic details about the infected computer and checked whether it could reach common online services.

After a gap of about three days, the operators returned with a more active stage that used a dedicated server at 185.82.218[.]119 for tasking and data transfer.

Symantec observed a burst of seven commands in about 30 seconds, suggesting an operator was working directly on the compromised system.

Stolen key enabled a route back in

The operators placed an SSH private key on the host and used it to open a connection to their server. The tunnel gave them a route from their own infrastructure back into the shipbuilder’s internal network.

Unlike a short remote session, a tunnel can provide a continuing path through a compromised machine. Soon after it was opened, the operators checked internal hostnames, indicating that they were mapping the network.

The SSH tunnel was one of two ways the attackers sought to obtain or use account credentials. They also ran a PowerShell script that caused the computer to send an NTLM authentication response to a local listener. NTLM is a Windows method for proving a user’s identity.

Captured responses can create further risk if attackers can crack them or use them to try to access other systems.

The operators checked account and group details, looked up more internal systems, and gathered information about running processes and installed updates.

They stopped the SSH process the following day, but Hookedge continued to contact the operators’ server in later bursts. The report does not confirm why the tunnel was closed or what data, if any, was taken.

This use of tunnels fits a wider pattern in which APT28 has relied on less obvious routes and services to support its operations.

Cyber Security News has also reported on APT28 abuse of cloud services, a separate campaign that highlights why defenders should check how programs behave, not just whether a website is known or trusted.

On July 31, the operators ran a program named ld.exe with an encrypted file called Events.dat. The loader decrypted its input in memory and called a function named ExecuteLoader.

Symantec found that the file supplied to the loader was not recovered, so the final payload and its purpose remain unknown. The loader was still present on the host weeks later, and the Hookedge launcher was seen again on September 24.

The report places the shipbuilder incident within a wider campaign against defense and government-related targets in two NATO countries.

The combination of a backdoor, credential theft, internal network checks and a tunnel suggests a sustained effort to gain access and collect intelligence.

The available evidence does not show whether the attackers reached other systems or obtained sensitive shipbuilding information.

Organizations should investigate suspicious Word attachments, unexpected scripts in user folders, hidden Edge activity and unapproved SSH connections.

They should review endpoint, email, DNS and proxy logs for the indicators below, check for signs of NTLM credential exposure, and rotate affected credentials if compromise is suspected.

The report advises treating Hookedge activity as a possible ongoing intrusion rather than assuming that removing one file ends the threat.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303	Hookedge dropper
SHA-256	e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8	Hookedge dropper
SHA-256	e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe	Hookedge dropper
SHA-256	60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3	Hookedge dropper
SHA-256	1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e	Hookedge dropper
SHA-256	a3b44405112e6364444e7d96630edfabcf81e5ad37d690c3ebc73770d62aeabd	Hookedge dropper
SHA-256	6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f	Hookedge dropper
SHA-256	c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44	Hookedge dropper
SHA-256	ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb72	Hookedge dropper
SHA-256	5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645	Hookedge dropper
SHA-256	49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495	Hookedge dropper
SHA-256	39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b	Hookedge dropper
SHA-256	1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335	Hookedge dropper
SHA-256	e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c	Hookedge dropper
SHA-256	2fceca3460a35eea2c1c47d73c27c27edae95d2ae29ffb4ec2222d1a223b4bd	Hookedge dropper
SHA-256	68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7	Hookedge dropper
SHA-256	a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13	Hookedge dropper
SHA-256	063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543	Hookedge VBS launcher
SHA-256	d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40	Hookedge VBS launcher
SHA-256	aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e	Hookedge VBS launcher
SHA-256	f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff	ld.exe reflective loader
IP address	185.82.218[.]119	Operator server
URL	hxxps://webhook[.]site/890efd8d-6e9e-428a-bcf9-987745d71000	Hookedge endpoint
URL	hxxps://webhook[.]site/53379b62-8020-41cf-af57-effa6e1e8506	Hookedge endpoint
URL	hxxps://webhook[.]site/5b73dc69-d765-4440-a4d2-e9eb33283eb9	Hookedge endpoint
URL	hxxps://webhook[.]site/d828b9fc-5435-4b1c-881f-d6350c11d0b6	Hookedge endpoint
URL	hxxps://webhook[.]site/ca3c058e-3c88-449b-8299-822cd5d5e17c	Hookedge endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.