APT28 Hackers Open Secret SSH Tunnel Into NATO Country’s Naval Shipbuilder Network

Russian cyberespionage group APT28 used the Hookedge backdoor to reach a naval shipbuilder’s network in a NATO member state, steal login material and set up a hidden SSH tunnel.

The intrusion lasted at least two months, according to a report by Symantec’s Threat Hunter Team. The report does not name the shipbuilder or the country.

It also describes activity against organizations in a second NATO member state, including a law enforcement agency and a maker of military aircraft engines.

APT28, also known as Fancy Bear and Forest Blizzard, is referred to as Swallowtail in Symantec’s report. Researchers from Symantec identified Hookedge activity at the three organizations.

Their findings add detail to earlier public reporting on the malware, including this report on Hookedge targeting, which described the backdoor’s use of Word documents and web services.

APT28 Hackers

At the shipbuilder, the activity began on July 24, 2026, when a malicious Word document was opened from the Outlook attachment cache. Its hidden macro wrote several files to the user’s profile and started the infection chain.

One of those files launched Hookedge, a backdoor that can fetch instructions, run commands and send back their output. The malware used a hidden Microsoft Edge window to contact webhook.site, a public web service.

The use of a familiar browser and a legitimate service could make the traffic harder to spot among normal web activity. An earlier Hookedge campaign analysis also describes how the backdoor used Edge and webhook services to receive instructions and return results.

The first commands gathered basic details about the infected computer and checked whether it could reach common online services.

After a gap of about three days, the operators returned with a more active stage that used a dedicated server at 185.82.218[.]119 for tasking and data transfer.

Symantec observed a burst of seven commands in about 30 seconds, suggesting an operator was working directly on the compromised system.

Stolen key enabled a route back in

The operators placed an SSH private key on the host and used it to open a connection to their server. The tunnel gave them a route from their own infrastructure back into the shipbuilder’s internal network.

Unlike a short remote session, a tunnel can provide a continuing path through a compromised machine. Soon after it was opened, the operators checked internal hostnames, indicating that they were mapping the network.

The SSH tunnel was one of two ways the attackers sought to obtain or use account credentials. They also ran a PowerShell script that caused the computer to send an NTLM authentication response to a local listener. NTLM is a Windows method for proving a user’s identity.

Captured responses can create further risk if attackers can crack them or use them to try to access other systems.

The operators checked account and group details, looked up more internal systems, and gathered information about running processes and installed updates.

They stopped the SSH process the following day, but Hookedge continued to contact the operators’ server in later bursts. The report does not confirm why the tunnel was closed or what data, if any, was taken.

This use of tunnels fits a wider pattern in which APT28 has relied on less obvious routes and services to support its operations.

Cyber Security News has also reported on APT28 abuse of cloud services, a separate campaign that highlights why defenders should check how programs behave, not just whether a website is known or trusted.

On July 31, the operators ran a program named ld.exe with an encrypted file called Events.dat. The loader decrypted its input in memory and called a function named ExecuteLoader.

Symantec found that the file supplied to the loader was not recovered, so the final payload and its purpose remain unknown. The loader was still present on the host weeks later, and the Hookedge launcher was seen again on September 24.

The report places the shipbuilder incident within a wider campaign against defense and government-related targets in two NATO countries.

The combination of a backdoor, credential theft, internal network checks and a tunnel suggests a sustained effort to gain access and collect intelligence.

The available evidence does not show whether the attackers reached other systems or obtained sensitive shipbuilding information.

Organizations should investigate suspicious Word attachments, unexpected scripts in user folders, hidden Edge activity and unapproved SSH connections.

They should review endpoint, email, DNS and proxy logs for the indicators below, check for signs of NTLM credential exposure, and rotate affected credentials if compromise is suspected.

The report advises treating Hookedge activity as a possible ongoing intrusion rather than assuming that removing one file ends the threat.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post APT28 Hackers Open Secret SSH Tunnel Into NATO Country’s Naval Shipbuilder Network appeared first on Cyber Security News.