APT28 (Swallowtail) used the HOOKEDGE backdoor against a law-enforcement agency, a naval shipbuilder and an aircraft-engine maker in two NATO states; at the shipbuilder it then pushed an SSH key for a persistent tunnel, captured NTLM handshakes and ran a reflective loader

Symantec's Threat Hunter Team reports that Swallowtail, which it equates with APT28, Fancy Bear and Forest Blizzard, targeted organizations in two NATO member states: a law-enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines, none named (Symantec, 2026-10-20). Recorded Future had documented the HOOKEDGE backdoor in August, from campaigns between late September 2025 and early April 2026 against government and diplomatic organizations in Romania, Spain and Turkiye, and assesses with moderate confidence that BlueDelta, which overlaps APT28, is behind it (Recorded Future, 2026-08-27).

At the shipbuilder the vector was a macro-enabled Word document opened from the Outlook attachment cache on 2026-07-24, so it arrived by email; its macro dropped a VBScript launcher, an HTML pair that auto-submits a hidden form to a webhook endpoint and a batch script (Symantec, 2026-10-20). The batch script kills any running Microsoft Edge and restarts it as a one-pixel, off-screen window carrying an inline script instead of a URL, so the browser fetches the next task from the public webhook.site service, and the batch script then runs the task and uploads its output to the same endpoint (Symantec, 2026-10-20). A second stage then took its tasks from a dedicated address, and seven tasks arrived in about 30 seconds, a cadence Symantec reads as interactive (Symantec, 2026-10-20).

The operators then pushed an SSH private key onto the host and at once opened an outbound SSH session to their own server with host-key checking disabled, legacy RSA algorithms enabled and a background remote port forward, a persistent route into the internal network; separately a short PowerShell script ran an HTTP listener on loopback and net use against it, forcing the host to authenticate to itself so the NTLM handshake could be captured (Symantec, 2026-10-20). On 2026-07-31 they ran a previously undocumented reflective loader, which decrypts an encrypted file in memory; the payload was not recovered, and the launcher was last seen on 2026-09-24 (Symantec, 2026-10-20).

Triage: the distinctive sequence is an Office document's script host, then Edge killed and relaunched as a one-pixel off-screen window carrying an inline script instead of a URL; the Edge launch alone is not the signal.