APT28 Deploys New Reflective Loader and HOOKEDGE Variant Against NATO Naval Shipbuilder

Symantec researchers attribute a persistent espionage campaign targeting NATO defense firms and law enforcement to the Russian-linked APT28 group, noting new loader tools.

Threat Times Intrusion DeskOctober 20, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek submarine hull rests in a dry dock, surrounded by complex industrial piping and concrete walls. — AI-generated illustration: Threat Times

Key points

APT28 attackers used a new reflective loader and HOOKEDGE backdoor variants against a NATO naval shipbuilder in late July 2026.
The campaign also targeted a military aircraft engine manufacturer and a law enforcement agency across two NATO member states.
Symantec observed hands-on-keyboard activity where operators stole credentials and established persistent SSH tunnels into internal networks.

Symantec’s Threat Hunter Team attributed a recent cyber espionage campaign to the Russia-linked APT28 group, which targeted defense contractors and law enforcement in two NATO member states. The activity, tracked under the moniker Swallowtail, involved the deployment of a previously undocumented reflective loader and updated variants of the HOOKEDGE backdoor.

During an attack on a naval shipbuilder in late July 2026, operators engaged in hands-on-keyboard activity over a week. They used two distinct techniques to steal credential material, opened a persistent SSH tunnel into the organization’s internal network, and deployed the new reflective loader to decrypt and run encrypted payloads in memory.

Context and Background

The HOOKEDGE backdoor shares significant code overlap with HEADLACE, a modular Windows implant APT28 has used against diplomats since April 2023. Recorded Future’s Insikt Group first publicly documented HOOKEDGE in late August 2026, linking it to espionage campaigns in Romania, Spain, and Türkiye between September 2025 and early April 2026.

Traditionally, HOOKEDGE is delivered via macro-enabled Microsoft Word documents and communicates through a webhook[.]site URL. Infected machines fetch tasks using a hidden Microsoft Edge browser instance rather than a traditional downloader. This method allows attackers to stage tasks and receive execution output without relying on standard executable downloaders.

Who Is Affected

The Swallowtail activity cluster targeted entities holding sensitive information valuable to foreign intelligence agencies. According to Symantec, victims included a naval shipbuilder, a manufacturer of military aircraft engines, and a law enforcement agency. These targets span two member states of the North Atlantic Treaty Organization, continuing APT28’s long-standing focus on defense and diplomatic sectors.

In the specific attack against the naval shipbuilder, threat actors abandoned the usual webhook[.]site communication channel. Instead, they used new HOOKEDGE variants that communicated with a dedicated IP address, 185.82.218[.]119 on port 443, for both tasking and data exfiltration. That suggests the group is adapting its infrastructure to avoid detection associated with known command-and-control domains.

What should you do?

Symantec shared these findings in a report provided to The Hacker News. No patch or software update has been confirmed yet to mitigate this specific reflective loader or HOOKEDGE variant. Organizations should monitor for suspicious browser activity and unexpected outbound connections to dedicated IP addresses.

Threat Times previously reported on October 20, 2026, that APT28 used the HOOKEDGE backdoor to infiltrate European defense firms and a law enforcement agency, highlighting the group’s persistent interest in NATO-aligned targets.

What to do and how to stay safe: APT28

Monitor network traffic for connections to known APT28 infrastructure, including the IP address 185.82.218[.]119 on port 443, and block identified command-and-control endpoints.
Inspect macro-enabled Microsoft Word documents and other email attachments for suspicious scripts, as these remain a primary delivery vector for the HOOKEDGE backdoor.
Watch for hidden or off-screen instances of Microsoft Edge browser launching without user interaction, which may indicate the backdoor is fetching tasks from remote servers.
Review logs for persistent SSH tunnels and unusual credential access patterns, as attackers have used hands-on-keyboard techniques to maintain access and exfiltrate data.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is behind the recent attacks on NATO defense contractors?

The Russia-linked state-sponsored threat actor known as APT28, also tracked as BlueDelta, Fancy Bear, and Forest Blizzard, is attributed to these attacks.

What new tool did APT28 deploy in the July 2026 attack?

Attackers deployed a previously undocumented reflective loader designed to decrypt and run encrypted payloads in memory using a runtime cryptographic key.