Symantec: APT28 Used Hookedge Backdoor to Hit NATO Defense Firms and Police

Symantec researchers reported on Tuesday that Russian government-linked hackers compromised two defense firms and a law enforcement agency in NATO countries. The group behind these intrusions is Swallowtail, also known as APT28, Fancy Bear, and Forest Blizzard, which has strong ties to the Russian military intelligence agency GRU.

The attackers targeted a naval shipbuilder, a manufacturer of military aircraft engines, and a law enforcement agency. During the intrusion of the shipbuilder, Symantec observed repeated hands-on-keyboard activity over a week-long period. This behavior indicates that human operators were manually selecting actions to steal credentialed material, rather than relying on automated malware routines.

Tactics and Tools

The campaign utilized the Hookedge backdoor, which Recorded Future’s Insikt Group first identified in August. Insikt had previously documented attacks from September of the prior year involving the same group and backdoor against defense and diplomatic targets in Romania, Spain, and Turkey. Symantec noted that this current activity aligns with broader intelligence collection efforts aimed at European government and defense entities.

Symantec also observed the deployment of a previously undocumented loader named ld.exe. This tool decrypts its payload in memory and requires a key supplied only at runtime via the command line. Without both the encrypted file and the specific key, the payload cannot be recovered. Researchers were unable to recover the payload, so its specific function remains unknown.

Target Selection and Motives

Dick O’Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop that the hands-on-keyboard activity confirms the organizations were genuine targets. He noted that this manual interaction proves further exploitation beyond the initial infection was attempted. The careful selection of targets suggests a deliberate espionage campaign rather than accidental infections.

O’Brien speculated that the motive might relate to campaigns targeting nations aiding Ukraine in its war against Russia. However, he emphasized that the specific motive was not certain. The shift to using a dedicated server for sensitive follow-up activity surprised researchers, who had expected the group to continue hopping between free services as seen in previous operations.

What should you do?

Security teams should monitor for indicators of compromise related to the Hookedge backdoor and unusual loader behaviors. Organizations should review logs for signs of manual operator activity, such as irregular access patterns to sensitive files.

What to do and how to stay safe: Symantec

• Monitor network traffic for connections to known malicious infrastructure associated with the Hookedge backdoor.
• Review endpoint logs for unusual process executions, particularly those involving command-line arguments that could supply runtime keys.
• Audit access logs for sensitive data repositories to detect manual credential theft or irregular file access patterns.
• Verify that security tools are updated to detect previously undocumented loaders like ld.exe once vendor signatures are released.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which threat actor is responsible for these attacks?

The attacks were conducted by Swallowtail, also known as APT28, Fancy Bear, and Forest Blizzard, a group linked to the Russian GRU.

What tools did the hackers use in this campaign?

The hackers used the Hookedge backdoor and a previously undocumented loader named ld.exe to infiltrate the targets.

Who were the targets of this espionage campaign?

The targets included a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency in NATO countries.