Executive Summary
Between July and September 2026, the Russian GRU-linked actor APT28 (also known as Swallowtail or Forest Blizzard) conducted a targeted espionage campaign against three organizations in two European NATO member states. The confirmed victims include a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. The campaign focused on long-term access and intelligence collection related to naval and aerospace propulsion technologies.
The attack chain began with spear-phishing emails containing macro-enabled Word documents that deployed HOOKEDGE, a batch-script backdoor. Adversaries then transitioned C2 from public webhook services to dedicated infrastructure at 185.82.218[.]119. Once inside, they utilized NTLM loopback authentication for credential theft and established persistent reverse SSH tunnels. A significant new development is the use of a reflective loader, ld.exe, which executes encrypted payloads (Events.dat) entirely in memory using a runtime-only key, effectively defeating disk-based forensics.
This activity represents a shift toward more hardened tradecraft designed to evade automated sandboxes and resist post-incident analysis. Given the target profile and the unidentified nature of the final memory-resident payloads, organizations in the defense manufacturing and government sectors should treat any detection of HOOKEDGE as a high-priority, potentially still-active intrusion.