Symantec’s researchers say a Russian espionage group they call Swallowtail targeted organizations in two NATO countries. The group is also known as APT28, Fancy Bear and Forest Blizzard. Its targets were a law enforcement agency, a naval shipbuilder and a maker of military aircraft engines. At the shipbuilder it ran a long intrusion. The attackers used a backdoor called HOOKEDGE, sent in a Word document with a macro, and steered it through the webhook.site service.
Recorded Future’s Insikt Group described the same backdoor in August. This post puts both reports side by side, follows the attack chain and ends with a checklist you can act on today. Symantec does not name the countries or the victims, and neither do we.
What Did Symantec and Recorded Future Each Find?
The two reports look at different parts of the same activity. Recorded Future studied the lures, the dropped files and the infrastructure across many months. Symantec followed what happened after the infection inside one victim.
| Topic | Symantec | Recorded Future |
|---|---|---|
| Published | 20 October 2026 | August 2026 |
| Group name | Swallowtail (APT28) | BlueDelta, which overlaps with APT28 |
| Attribution | Cites the US government for the GRU link, no confidence level in the text | Moderate confidence, based on code and tradecraft overlap with HEADLACE |
| Targets | Law enforcement agency, naval shipbuilder, aircraft engine maker | Government, diplomatic and defense manufacturing bodies in Romania, Spain and Türkiye |
| Period | Shipbuilder intrusion from 24 July 2026 | Late September 2025 to early April 2026 |
| Main value | What the attackers did after the infection | Lures, files, infrastructure and changes over time |
| Files the macro drops | Four | Six |
The file counts differ most likely because Symantec describes one intrusion and Recorded Future several campaigns. Both agree on the core: a macro-enabled Word document, a batch script backdoor and webhook.site as the main control channel. Recorded Future also links HOOKEDGE to HEADLACE, an earlier BlueDelta backdoor it calls the likely predecessor.
Our HOOKEDGE backdoor profile keeps the names, the techniques and the sources in one place.
How Does the HOOKEDGE Attack Chain Run?
The chain starts with a document and ends with a quiet loop that fetches and runs commands. The ATT&CK ids below are our own mapping of both reports. Recorded Future lists its own ids in an appendix, among them T1204.002 and T1041; Symantec gives none.
- Word lure arrivesA document with a macro, likely sent as an email attachmentTechnique T1566.001 (MITRE ATT&CK, opens in a new tab)
- Macro runsThe AutoOpen routine drops script files into the user profileTechnique T1204.002 (MITRE ATT&CK, opens in a new tab)
- Hidden Edge windowEdge starts in a one pixel window placed off screenTechnique T1564.003 (MITRE ATT&CK, opens in a new tab)
- Task from webhook.siteThe task is saved as a cmd file and runTechnique T1102.002 (MITRE ATT&CK, opens in a new tab)
- Output posted backThe result goes to a webhook, a separate one in Recorded Future’s samplesTechnique T1041 (MITRE ATT&CK, opens in a new tab)
- Follow-on at one victimSSH tunnel, NTLM capture and the ld.exe loaderTechnique T1572 (MITRE ATT&CK, opens in a new tab)
Recorded Future says a first stage scheduled task starts the backdoor every 30 minutes. It also saw a 20 minute interval in October 2025 samples and a later rise to 61 minutes. Each run uses two webhooks, one for tasks and one for results. The installer then deletes itself. Until the July 2026 campaigns, a hidden image in the document also pinged a webhook when the file was opened, which told the operators the lure worked.
Victims of higher interest got a second stage. Recorded Future says it beacons as often as every five minutes. At the shipbuilder, Symantec saw the second stage leave webhook.site and use a dedicated IP address for tasks and for stolen data.
What Happened Inside the Shipbuilder?
Symantec says the operators came back to one compromised host repeatedly over a week, which looked like hands-on-keyboard work. HOOKEDGE was still on the host at least two months after the first infection, from 24 July to 24 September.
- 24 JulyWord document openedIt came from the Outlook attachment cache. The first task was a reconnaissance batch.
- 27 JulySecond stage and SSH tunnelTasks now came from a dedicated IP address. An SSH key was pushed and a background tunnel opened.
- 27 JulyNTLM captureA PowerShell script made the host sign in to itself and recorded the NTLM exchange.
- 28 JulyTunnel closedThe operators ended the ssh.exe process. Symantec says the reason is not clear.
- 31 Julyld.exe runThe reflective loader ran with a key and an encrypted file named Events.dat.
- 24 SeptemberLauncher seen againSymantec’s most recent sighting of the HOOKEDGE launcher on the host.
The loader, ld.exe, is new. It decrypts a file in memory and calls an exported function named ExecuteLoader, a method known as reflective code loading. Symantec recovered the key and the file name but not the payload, so what it finally ran is unknown, Symantec says.
The NTLM trick deserves a note. The script opens a fake web listener on the machine’s own loopback address and forces the machine to sign in to it. The exchange it captures can be cracked offline or relayed to another host, Symantec explains.
What Should Defenders Check?
Recorded Future gives the broad advice and Symantec gives the exact behavior. Together they make a short checklist.
- Block internet macrosDisable macros in documents from the internet and restrict unsigned VBA, as Recorded Future advises.
- Review webhook.site trafficBlock it if your company does not use it. Recorded Future expects a move to another legitimate service if webhook.site is disrupted.
- Alert on odd Edge launchesHeadless mode, data URLs, local HTML files or a one pixel off-screen window.
- Watch scheduled tasksTasks that start wscript, cscript, cmd or powershell from user writable folders.
- Look for SSH on workstationsAn ssh.exe with a remote forward and a key stored in ProgramData.
- Hunt for NTLM self captureA PowerShell listener on the loopback address with a net use call to localhost.
- Search for the indicatorsSymantec lists hashes, one IP address and webhook.site addresses.
Symantec shows the Edge command line it saw: msedge.exe --window-size=1,1 --window-position=10000,10000 --ignore-certificate-errors followed by a base64 data URL. Its SSH line used StrictHostKeyChecking=no, port 80 and the flags -Nf.
Two of Symantec’s indicators are the address 185.82.218[.]119 and the ld.exe SHA-256 hash f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff. Fresh webhook addresses are cheap, so hunt for behavior as well as indicators.
Symantec also warns that a HOOKEDGE find may not be the whole story. Treat it as possibly ongoing, and look for the tunnel, the credential theft and the loader. Recorded Future notes that the group has relied on credential theft to widen access, so it advises phishing-resistant multi-factor authentication on email, VPN and other external services.
Why Do Shipbuilders and Engine Makers Matter to This Group?
Symantec says all three targets were likely to hold information of direct interest to a foreign intelligence service. It describes the group as mainly aiming at military, defense and government targets in Europe and North America. Our APT28 threat group profile lists defense and military bodies and NATO members among its targets.
For a supplier in the defense industry, the lesson is plain. The way in was a Word attachment opened by a user, not a flaw in a firewall. Email filtering, macro policy and user execution controls are the first line, and egress monitoring is the second. Most of what followed the phishing email used built-in Windows tools such as Edge, curl and OpenSSH, plus a public web service. So behavior rules matter as much as file scanning.
What Do We Still Not Know?
The payload of ld.exe was not recovered. Symantec does not name the victims or the two NATO countries, and neither report says how many organizations were hit overall. Recorded Future bases its attribution on code and tradecraft overlap with HEADLACE, infrastructure patterns and targeting. Symantec relies on the US government’s statement that the group is a GRU unit.
We also looked at public talk. In the dark web and Telegram sources we searched, from 21 September to 21 October 2026, HOOKEDGE appears in nine posts. Eight were published on 20 and 21 October, and all nine relay news coverage of the two reports. None of them offers or shares the tooling.