APT28 Infiltrates NATO Naval Shipbuilder, Establishes Covert SSH Tunnel
Russian state-sponsored group APT28 has been detected using the Hookedge backdoor to breach a NATO naval shipbuilder's network, establishing a hidden SSH tunnel to maintain persistent access and exfiltrate credentials.
The Russian cyberespionage group APT28, also known by researchers as Forest Blizzard and Swallowtail, has successfully infiltrated the network of a naval shipbuilder located in a NATO member state. The intrusion, which lasted for at least two months, involved the deployment of the Hookedge backdoor, the establishment of a covert SSH tunnel, and the theft of sensitive credentials. Symantec's Threat Hunter Team detailed the operation, noting that the specific shipbuilder and country were not disclosed.
The attack chain commenced on July 24, 2026, when a victim opened a malicious Word document delivered as an Outlook attachment. This document contained a hidden macro that, upon execution, deployed several files to the user's profile, initiating the infection process. One of these files launched Hookedge, a sophisticated backdoor capable of receiving commands, executing them on the compromised system, and returning the results to its operators.
To maintain command and control (C2), Hookedge utilized a public web service, webhook.site, through a hidden Microsoft Edge browser window. This technique aimed to blend malicious traffic with legitimate web activity, making detection more challenging for security defenses. Researchers observed that after an initial reconnaissance phase, the attackers shifted to a dedicated server at 185.82.218[.]119 for more active tasking and data transfer, indicating direct operator involvement.
A critical phase of the intrusion involved the attackers placing an SSH private key on the compromised host. This key was used to establish an SSH tunnel, providing a persistent, encrypted pathway from the attackers' infrastructure directly into the shipbuilder's internal network. This tunnel allowed the threat actors to explore internal hostnames and map the network, suggesting a deliberate effort to understand the target environment for further exploitation.
Beyond the SSH tunnel, APT28 also employed a PowerShell script to capture NTLM authentication responses. This method of credential theft is particularly dangerous as stolen NTLM hashes can be cracked offline or used in pass-the-hash attacks to gain access to other systems within the network. The attackers actively queried account and group details, scanned for additional internal systems, and gathered information on running processes and system updates.
While the SSH tunnel was eventually closed, the Hookedge backdoor continued its communication with the C2 server. The report also noted the presence of a loader program, ld.exe, which executed an encrypted file named Events.dat. The final payload delivered by this loader could not be recovered, leaving its ultimate purpose unknown. However, the sustained presence of the loader and repeated Hookedge activity suggest a prolonged and determined espionage campaign.
The incident is part of a broader pattern of APT28 targeting defense and government-related entities in NATO countries. The group's reliance on less conspicuous methods, such as abusing legitimate services and establishing covert tunnels, underscores the evolving tactics of sophisticated state-sponsored actors. Organizations are advised to scrutinize suspicious documents, unusual scripts, hidden browser activity, and unapproved SSH connections, and to review logs for signs of credential compromise.