APT28 Spent 2 Months Inside a NATO Naval Shipbuilder and Left Behind a Loader Nobody Had Seen Before

A Russian military intelligence unit breached a NATO naval shipbuilder, operated undetected for at least 2 months, stole credentials through 2 independent techniques, and deployed a reflective loader whose final payload was never recovered. The intrusion, documented by threat hunters at Broadcom's security research division, covers the full kill chain from initial access through credential theft and loader deployment against a defense-industrial target [1]. The encrypted payload file, Events.dat, remains unrecovered. Whatever it was built to do, analysts do not know.

Who APT28 Is

APT28 is GRU Unit 26165, Russia's military foreign intelligence arm. The group has been active since at least the mid-2000s and operates with nation-state resources, institutional patience, and consistent strategic targeting [2]. A 2018 US grand jury indictment named 12 GRU officers in connection with operations attributed to the group, and six additional GRU officers from a separate unit were indicted in 2020 for the most destructive cyberattack series ever attributed to a single actor [3]. These are not isolated criminal actors. They are serving military officers executing collection programs on behalf of the Russian state.

FireEye's foundational 2017 attribution work established that APT28 malware was compiled predominantly during Moscow business hours, with 88% of samples compiled between 8AM and 6PM in the Moscow/St. Petersburg timezone [2]. That compilation discipline reflects institutional structure, not freelance behavior. The group's targeting has consistently mirrored Russian government strategic interests: NATO member states, defense ministries, weapons programs, and military infrastructure [2].

What Happened at the Shipbuilder

The Swallowtail campaign targeted 3 organizations across 2 NATO member states: a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines [1]. The shipbuilder intrusion is the most fully documented.

Initial access arrived via a macro-enabled Word document opened directly from the Outlook attachment cache on July 24, 2026 [1]. The macro used heavy obfuscation, splitting Visual Basic for Applications (VBA) source and strings into short fragments joined at runtime to defeat static antivirus scanning [1]. This delivered the Hookedge backdoor, a lightweight Windows batch script that uses a hidden off-screen Microsoft Edge browser instance rather than a conventional downloader to communicate with webhook.site for command-and-control (C2) [1].

Hookedge was first publicly documented by threat intelligence analysts in August 2026 and assessed as a direct evolutionary successor to APT28's earlier HEADLACE implant [4]. The Swallowtail report extends that picture significantly: after initial reconnaissance, operators abandoned webhook.site's shared infrastructure in favor of a dedicated attacker-controlled IP address for both tasking and exfiltration [1]. That shift from shared commodity infrastructure to dedicated C2 is a deliberate operational security decision, reducing the chance that webhook.site blocking would disrupt an active collection operation.

From the dedicated IP, operators conducted hands-on-keyboard activity, issuing 7 tasks in quick succession during a single session on July 27 [1]. Credential theft followed through 2 independent paths: a persistent SSH reverse tunnel from the victim network back to attacker-controlled infrastructure using the -R flag, and a self-contained PowerShell New Technology LAN Manager (NTLM) capture script that stood up a fake HTTP listener on loopback and forced the host to authenticate to itself via SMB-over-HTTP, capturing NTLMv2 challenge-response pairs for offline cracking or relay [1]. Dual-technique credential theft is deliberate redundancy. If one path is detected, the other survives.

The reflective loader, ld.exe, was then deployed [1]. It accepts an encrypted payload file and a runtime decryption key as command-line arguments, decrypts the payload in memory, and calls an exported function named ExecuteLoader [1]. No prior public documentation of this loader exists. The encrypted payload was not recovered. The intrusion infrastructure remained active through at least September 24, 2026, confirming a minimum 2-month dwell window [1].

Dwell Time Is the Point

A 2-month dwell period is not an accident or a detection failure that can be explained away by resource constraints. It is the intended operating posture for espionage-focused actors. A 2026 incident response analysis covering more than 500,000 hours of global engagements found that cyber espionage incidents carried a median dwell time of 122 days [5]. The global median across all incident types was 14 days [5]. The shipbuilder intrusion sits well inside the espionage band.

What makes the dwell time strategically significant is what it enables: credential accumulation, lateral movement scoping, and patient collection without triggering velocity-based detections. eCrime actors have compressed their own timelines considerably, and most enterprise detection architectures are calibrated around that faster threat profile. APT28 operates in a completely different band. A slow, credentialed, living-off-the-land intrusion running for weeks will consistently fall below those thresholds.

The Loader Signals a Deliberate Tooling Evolution

The reflective loader is the technical differentiator that separates this intrusion from prior APT28 playbooks. Reflective loading executes code directly from memory without writing the final payload to disk, making forensic recovery difficult and EDR (endpoint detection and response) detection harder. Sophisticated threat actors have broadly shifted toward memory-resident and living-off-the-land techniques to avoid the disk writes that signature-based detection relies on. The ld.exe loader is a purpose-built implementation of that shift, with the added complication that its payload file was never recovered and remains entirely unknown.

When read alongside APT28's prior use of GooseEgg, a custom post-compromise tool exploiting CVE-2022-38028 for Windows Print Spooler privilege escalation and credential theft [6], and the group's earlier documented use of OAuth abuse to bypass two-factor authentication [2], a pattern emerges that no single report captures alone. APT28 is building a post-compromise toolkit explicitly designed for environments where perimeter defenses have been supplemented by EDR, where macro execution from the internet is monitored, and where traditional malware signatures are deployed. Each new tool fills a gap created by improving defenses. The undocumented reflective loader is the current leading edge of that progression.

A Node in a Sustained Collection Program

The naval shipbuilder is not an isolated target. The GRU has been actively targeting Western logistics entities and technology companies as documented in a 2025 US Department of Defense advisory [7]. The Defense Industrial Base, defined by the Cybersecurity and Infrastructure Security Agency (CISA) as a worldwide complex of more than 100,000 companies and subcontractors supporting US military weapons systems, is a declared high-priority collection target for Russian military intelligence [8]. Naval shipbuilders produce platforms whose specifications, production timelines, propulsion systems, and acoustic signatures carry significant intelligence value for any adversary planning around NATO maritime capability.

APT28 has run parallel campaigns throughout this period. Operation MacroMaze, a late-2025 to early-2026 spear-phishing campaign, targeted European government, diplomatic, and critical infrastructure entities using the same macro-enabled document delivery and webhook.site C2 model seen in the Swallowtail campaign [9]. The HOOKEDGE backdoor appeared against government and diplomatic targets in Romania, Spain, and Turkey between September 2025 and April 2026 [4]. The GRU is running concurrent, parallel collection operations across NATO member states, adapting shared tooling to specific target environments.

What This Means for Your Security Program This Week

The shipbuilder intrusion exposes 4 concrete detection gaps that defense-sector organizations should validate immediately.

• Confirm that your EDR is configured to alert on headless or hidden-window Microsoft Edge processes initiating outbound connections. The Hookedge delivery mechanism relies on Edge running off-screen to blend with legitimate browser traffic [1].
• Audit outbound connections to webhook.site and equivalent developer HTTP services. APT28 has now used this infrastructure across multiple documented campaigns [4], [9]. It should not be reachable from production endpoints.
• Validate that your NTLM authentication logging captures loopback SMB-over-HTTP attempts. The PowerShell capture script in this intrusion forced NTLM authentication on the local host, a technique that bypasses perimeter monitoring entirely [1].
• Test your detection coverage for SSH processes with the -R flag spawned outside of authorized administrative tooling. A persistent reverse tunnel to an external IP is not ambiguous behavior [1].

Threat hunters at Broadcom's security research division put it plainly: organizations that find Hookedge indicators should treat the intrusion as potentially ongoing rather than concluded and look for credential-theft and tunneling activity rather than assuming the backdoor's installation was the full extent of the attackers' activity [1]. That framing applies before you find indicators, not after. An adversary with 2 months of access and recovered credentials has options that extend well beyond the initial foothold. The payload in Events.dat remains unknown. That gap alone should drive a proactive hunt.

References

1. Broadcom / Symantec (security.com), "Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries," Broadcom / security.com, 20-Oct-2026. [Online]. Available: https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets [Accessed 26 Oct. 2026].
2. Model Diplomat, "Fancy Bear: Russian Cyber-Espionage Group," Model Diplomat, n.d.. [Online]. Available: https://modeldiplomat.com/learn/glossary/fancy-bear [Accessed 26 Oct. 2026].
3. U.S. Department of Justice, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace," 2020-10-19. [Online]. Available: https://www.justice.gov/archives/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and [Accessed 26 Oct. 2026].
4. Mandiant (FireEye iSIGHT Intelligence), "APT28: At the Center of the Storm," FireEye, Inc., Jan. 2017. [Online]. Available: https://services.google.com/fh/files/misc/apt28-at-the-center-of-the-storm.pdf [Accessed 26 Oct. 2026].
5. R. Lakshmanan, "APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations," The Hacker News, 28-Aug-2026. [Online]. Available: https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html [Accessed 26 Oct. 2026].
6. Mandiant / Google Threat Intelligence Group (GTIG), "Special Report: M-Trends 2026," Mandiant, 2026. [Online]. Available: https://cloud.google.com/security/resources/m-trends [Accessed 26 Oct. 2026].
7. CrowdStrike, "CrowdStrike 2026 Global Threat Report: Year of the Evasive Adversary," CrowdStrike, 2026. [Online]. Available: https://www.crowdstrike.com/en-us/global-threat-report/ [Accessed 26 Oct. 2026].
8. WA Security Operations Centre (WA SOC), "Windows Print Spooler Elevation of Privilege Vulnerability - 20240423002," WA Security Operations Centre (WA SOC), 2024-04-23. [Online]. Available: https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/ [Accessed 2024].
9. U.S. Department of Defense, "Russian GRU Targeting Western Logistics Entities and Technology Companies," U.S. Department of Defense / Defense Visual Information Distribution Service, 2025. [Online]. Available: https://media.defense.gov/2025/May/21/2003719846/-1/-1/0/CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF [Accessed 2025].

How Anomali Can Help

APT28's undocumented reflective loader evaded standard defenses for two months, exactly the gap ThreatStream Next-Gen, Out-of-the-Box Detections, and Malware Intelligence feeds are built to close.

• Anomali ThreatStream provides access to 200+ specialised threat intelligence feeds, mapping the IOCs, TTPs, and threat actor infrastructure described above directly to your security operations.
• Anomali provides out-of-the-box detections aligned to MITRE ATT&CK, covering the TTPs described above so teams can deploy coverage for these techniques without writing rules from scratch.
• Anomali's Malware Intelligence Channel tracks 300+ malware and ransomware families, delivering real-time hashes, IPs, domains, and C2 infrastructure indicators for the families described above, curated by the Anomali Threat Research team.

Can your current stack detect an undocumented reflective loader before it spends weeks inside your network?

Talk to Anomali →

‍