Russian cyberspies have targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a military aircraft engine manufacturer. The attacks were focused on stealing sensitive information related to national security and defense.
Symantec’s threat hunter team attributes the campaign to a threat actor it tracks as Swallowtail, more commonly known as APT28, Fancy Bear and Forest Blizzard. APT28 has been active since at least 2004. Western intelligence agencies link APT28 directly to Unit 26165 and Unit 74455 of Russia’s Main Intelligence Directorate (GRU).
According to Symantec, one intrusion at a naval shipbuilder lasted at least two months. The attackers repeatedly accessed a compromised computer, stole credentials and created a persistent SSH tunnel to connect their server to the company’s internal network.
The attackers used the Hookedge backdoor delivered via malicious Word documents containing macros. Once activated, Hookedge communicates through the webhook.site service to receive commands and send stolen data. In a more advanced stage of the attack, the operators switched to a dedicated IP address for command-and-control (C&C) communications and data theft.
“Once executed, the AutoOpen routine dropped four files into the user's profile to initiate the Hookedge infection chain: a VBScript launcher, an HTML/XHTML pair designed to auto-submit a hidden form to a webhook endpoint as soon as it loaded, and a batch script,” the threat research team noted.
Researchers also discovered a previously undocumented tool named ld.exe. It is a reflective loader that decrypts an encrypted payload directly in memory and executes it using a function called ExecuteLoader. The researchers were able to recover the specific key and encrypted-payload filename used in one execution, but the payload itself was not recovered, so its ultimate function is unknown.
The attackers used two techniques for credential theft - an SSH private key to establish remote access and a PowerShell script that captures an NTLM authentication handshake through a local listener.
“The targeting in this campaign spans two NATO member states and three distinct sectors of national security relevance: law enforcement, defense manufacturing and shipbuilding[…] The tradecraft observed after initial access, credential theft through two independent techniques, a persistent network tunnel, and a previously undocumented loader, goes beyond the delivery mechanism that has so far been publicly reported on this campaign,” Symantec said.