Symantec reports that Russia's Swallowtail (APT28 / Fancy Bear / Forest Blizzard) hit a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two unnamed NATO countries using the Hookedge backdoor, first documented by Recorded Future in August. At the shipbuilder, a macro-enabled Word attachment was opened on Jul 24, 2026. Hands-on activity followed on Jul 27-31, and the launcher was still seen on Sept 24. Symantec says organizations that find Hookedge should treat the intrusion as possibly ongoing.

1. Hidden Edge as a downloader: process creation of msedge.exe with --window-size=1,1 --window-position=10000,10000 --ignore-certificate-errors "data:text/html;base64,...", usually right after a batch file runs taskkill /f /im msedge.exe and deletes %userprofile%\Downloads\*.000, *.tmp, *.crdownload. Also flag Office spawning wscript/cmd that drops VBS + HTML/XHTML + BAT into the user profile.
2. C2: workstation traffic to webhook.site (Symantec lists GUID paths 890efd8d-6e9e-428a-bcf9-987745d71000, 53379b62-8020-41cf-af57-effa6e1e8506, 5b73dc69-d765-4440-a4d2-e9eb33283eb9, d828b9fc-..., ca3c058e-...) and to 185.82.218[.]119 on 443. Recon used curl probes to Dropbox, Google, Microsoft login, Mega and 23.220.75.245.
3. Reverse tunnel: ssh.exe with -R and -Nf, -p 80, StrictHostKeyChecking=no, UserKnownHostsFile=NUL, +ssh-rsa, using a key at C:\ProgramData\Adobe\id_rsa. Also look for icacls/cacls changing ownership of a file named id_rsa.
4. NTLM self-capture: PowerShell creating System.Net.HttpListener on http://localhost:8080/ together with net use f: \\localhost@8080\c$ (WebDAV-style loopback auth to capture NetNTLMv2).
5. Loader: C:\ProgramData\ld.exe run with a 32-hex-character key and an encrypted file argument (Events.dat), SHA256 f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff. Symantec lists 17 Hookedge dropper hashes and 3 VBS launcher hashes. Sweep EDR telemetry for all of them.

If you get a hit, isolate the host, reset the user's credentials and any NTLM-exposed machine account, block outbound SSH from workstations, and hunt internal DNS lookups and pings from that host for lateral targets, especially mail servers.