---
title: Hunt: APT28 (Swallowtail) Hookedge intrusions at NATO-country defense firms: one-pixel off-screen Edge fetching from webhook.site, reverse SSH tunnel to 185.82.218.119, loopback NTLM self-capture, ld.exe reflective loader | ctxsec
url: https://ctxsec.com/items/hunt-swallowtail-apt28-hookedge-nato-defense
description: ""
status: "confirmed research (Symantec Threat Hunter Team, Oct 20) + hunt ideas"
published: 2026-10-20
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-swallowtail-apt28-hookedge-nato-defense.md)

confirmed research (Symantec Threat Hunter Team, Oct 20) + hunt ideas

2026-10-20

### Hunt: APT28 (Swallowtail) Hookedge intrusions at NATO-country defense firms: one-pixel off-screen Edge fetching from webhook.site, reverse SSH tunnel to 185.82.218.119, loopback NTLM self-capture, ld.exe reflective loader

Symantec reports that Russia's Swallowtail (APT28 / Fancy Bear / Forest Blizzard) hit a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two unnamed NATO countries using the **Hookedge** backdoor, first documented by Recorded Future in August. At the shipbuilder, a macro-enabled Word attachment was opened on Jul 24, 2026. Hands-on activity followed on Jul 27-31, and the launcher was still seen on Sept 24. Symantec says organizations that find Hookedge should treat the intrusion as possibly ongoing.

1. **Hidden Edge as a downloader:** process creation of `msedge.exe` with `--window-size=1,1 --window-position=10000,10000 --ignore-certificate-errors "data:text/html;base64,..."`, usually right after a batch file runs `taskkill /f /im msedge.exe` and deletes `%userprofile%\Downloads\*.000`, `*.tmp`, `*.crdownload`. Also flag Office spawning `wscript`/`cmd` that drops VBS + HTML/XHTML + BAT into the user profile.
2. **C2:** workstation traffic to `webhook.site` (Symantec lists GUID paths `890efd8d-6e9e-428a-bcf9-987745d71000`, `53379b62-8020-41cf-af57-effa6e1e8506`, `5b73dc69-d765-4440-a4d2-e9eb33283eb9`, `d828b9fc-...`, `ca3c058e-...`) and to `185.82.218[.]119` on 443. Recon used `curl` probes to Dropbox, Google, Microsoft login, Mega and `23.220.75.245`.
3. **Reverse tunnel:** `ssh.exe` with `-R` and `-Nf`, `-p 80`, `StrictHostKeyChecking=no`, `UserKnownHostsFile=NUL`, `+ssh-rsa`, using a key at `C:\ProgramData\Adobe\id_rsa`. Also look for `icacls`/`cacls` changing ownership of a file named `id_rsa`.
4. **NTLM self-capture:** PowerShell creating `System.Net.HttpListener` on `http://localhost:8080/` together with `net use f: \\localhost@8080\c$` (WebDAV-style loopback auth to capture NetNTLMv2).
5. **Loader:** `C:\ProgramData\ld.exe` run with a 32-hex-character key and an encrypted file argument (`Events.dat`), SHA256 `f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff`. Symantec lists 17 Hookedge dropper hashes and 3 VBS launcher hashes. Sweep EDR telemetry for all of them.

If you get a hit, isolate the host, reset the user's credentials and any NTLM-exposed machine account, block outbound SSH from workstations, and hunt internal DNS lookups and pings from that host for lateral targets, especially mail servers.

Sources: [Symantec: Swallowtail targets defense firms in two NATO countries (Oct 20)](https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets) · [The Record (Oct 20)](https://therecord.media/european-defense-contractors-fancy-bear-espionage)