"During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity," Symantec said. That observation, published in a technical briefing shared with The Hacker News, places a Russia-linked, state-sponsored actor known as APT28 squarely inside sensitive networks of at least two NATO member states and shows the group combining tried-and-true phishing with a newly observed in-memory loader.
Symantec's Swallowtail cluster and APT28 attribution
The activity was tracked by the Broadcom-owned Symantec Threat Hunter Team under the moniker Swallowtail and attributed to the actor commonly tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard). Symantec said targets included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines — organizations holding information of potential value to a foreign intelligence service.
HOOKEDGE, HEADLACE, and the newly observed reflective loader
Symantec linked the intrusions to a backdoor called HOOKEDGE and to a previously undocumented reflective loader. HOOKEDGE, first publicly documented by Recorded Future Insikt Group in late August 2026, is a barebones Windows batch script delivered via macro-enabled Microsoft Word documents. It accepts attacker-issued commands and returns results, communicating through a webhook[.]site URL and fetching tasks via a hidden, off-screen instance of Microsoft Edge rather than a traditional downloader.
Symantec reported that new HOOKEDGE variants abandoned webhook[.]site and instead used a dedicated IP — 185.82.218[.]119:443 — for both tasking and exfiltration. The reflective loader, observed as an executable named ld.exe and dropped using a curl command over SSH, is engineered to decode and run a next-stage component in memory; Symantec said the exact nature of that payload remains unknown.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadNaval shipbuilder intrusion: credential theft, SSH tunnels, and hands-on-keyboard access
In the incident affecting the naval shipbuilder in late July 2026, Symantec described a sequence that moved from initial macro-enabled delivery to active, interactive access. The attackers used two distinct credential-theft techniques: first, pushing an SSH private key to a compromised host and immediately using it to open a persistent, backgrounded SSH tunnel back to their server; and second, running a short PowerShell script that listened on the host loopback address and forced the machine to authenticate to it, capturing the resulting NTLM handshake.
Symantec observed repeated operator activity on the compromised host across a week and the deployment of the reflective loader. The report notes the most recent activity recorded in the shipbuilder's network on September 24, 2026, when a Visual Basic Script launcher associated with HOOKEDGE was seen. Symantec said it remains unclear whether any data was exfiltrated.
CERT‑UA, mobile-targeting, and related campaigns against Ukrainian entities
Symantec's findings sit alongside Ukrainian and other telemetry showing a broad set of Russian-linked operations in 2025–2026. The Computer Emergency Response Team of Ukraine (CERT‑UA) reported growing targeting of smartphones belonging to Ukrainian military personnel and government officials, including use of the DarkSword iOS exploit kit distributed via watering-hole compromises of legitimate news outlets and government sites.
Google Threat Intelligence Group in March 2026 linked UNC6353 to use of Coruna and DarkSword in watering-hole campaigns targeting Ukrainian users since summer 2025, the source said. CERT‑UA also reported Android threats: UAC‑0244 distributing CAMELSPY, which harvests device system information, geolocation, SIM details, contacts, call logs, and gallery images; and UAC‑0263 distributing BTMOB RAT, which permits remote control and data exfiltration from infected devices.
Additionally, CERT‑UA observed APT28 exploiting CVE‑2026‑21509 (a Microsoft Office security feature bypass) and CVE‑2026‑8496 (a zero-click SOGo webmail client vulnerability) to deliver COVENANT malware and to siphon mailbox credentials and data. Older techniques also remain in use: XSS vulnerabilities in Roundcube and macro-enabled Excel documents were reported as part of the actor's toolset.
LegionRelay, Team Cymru, and persistent tooling used against Ukraine
Team Cymru identified five additional command-and-control servers used in attacks against Ukrainian entities for a PowerShell-based RAT named LegionRelay, attributed to an actor called GREYVIBE. The newly identified LegionRelay C2 endpoints are listed by Team Cymru as:
- 91.149.221[.]118:8000
- 91.149.221[.]123:8000
- 166.88.239[.]54:8000
- 194.87.108[.]12:8000
- 194.87.108[.]217:8000
LegionRelay supports file enumeration, file exfiltration, screenshots, browser data theft, Telegram and WhatsApp data exfiltration, and RDP access setup — capabilities that Team Cymru said GREYVIBE has used persistently against Ukraine-related targets since at least August 2025.
What this means for naval shipbuilders, law enforcement, and aircraft engine manufacturers
- Naval shipbuilders: repeated hands-on-keyboard access, a persistent SSH tunnel from a planted private key, and deployment of an in-memory loader indicate attackers were prepared for extended lateral movement and stealthy next-stage execution; the presence of ld.exe and the dedicated IP 185.82.218[.]119:443 are concrete indicators defenders should hunt for.
- Law enforcement agencies: the use of macro-enabled delivery, PowerShell loopback NTLM capture, and webhook-style tasking shows credential theft and covert channel techniques remain central risk vectors for investigative and operational data.
- Military aircraft engine manufacturers: targeting alongside the naval shipbuilder and law enforcement suggests collection priorities aligned to technical and industrial data; organizations in this sector should consider the documented techniques — CVE exploitation, macros, and in-memory loaders — when assessing exposure.
The record in Symantec's briefing is starkly plain: an actor linked to a nation-state has combined legacy delivery (macro-enabled documents and watering-hole compromise) with newly observed tooling (a reflective loader loaded as ld.exe and tasking over a dedicated IP) and hands-on access inside sensitive networks. Symantec notes the tradecraft "goes beyond the delivery mechanism that has so far been publicly reported" — and, as of the most recent telemetry on September 24, 2026, it remains unknown whether those intrusions yielded exfiltrated data.
