Symantec: a booby-trapped Word file opened a military shipyard to Russian spies

On July 24, 2026, at a military shipyard in a NATO country, an employee opens a Word attachment received in Outlook. A few minutes later, a reconnaissance script is already downloaded onto their workstation. This was the start of an intrusion detailed on October 20 by the Threat Hunter team at Symantec, a Broadcom subsidiary.

Symantec attributes the campaign to Swallowtail. That is its name for the group better known as APT28 or Fancy Bear, which the US government describes as a Russian military intelligence (GRU) unit. There are three targets, in two unnamed NATO countries: the shipyard, a maker of military aircraft engines and a police department. According to The Record, the researchers say only that the victims are in Europe.

A backdoor already spotted this summer

The main tool is called Hookedge. This backdoor was first described in August by Insikt Group, the research team at Recorded Future, in another campaign targeting government and diplomatic entities. It arrives through a Word document with macros, whose code is split into fragments to evade antivirus software. It receives its orders through a hidden Edge browser window, first via the online service webhook.site, then via a dedicated IP address.

On July 27, three days after the infection, the operators step up their activity. They drop an SSH key on the workstation and open a permanent tunnel to their server, giving them a route into the internal network. They query internal machines and run a PowerShell script, before checking their privileges. This script forces the computer to authenticate to a fake local service in order to capture Windows password hashes (NTLM). According to Symantec, these hashes can then be cracked offline or reused.

On July 31, the operators launch a previously unseen tool, dropped the day before: a loader named ld.exe. It decrypts a file in memory and runs it. Without the key, supplied only at launch, the payload stays inert. Symantec did not recover this payload, so its function remains unknown. The loader was still present at the end of August, and the last observed activity dates to September 24.

What did the hackers take?

Nobody knows. Symantec does not know whether data was stolen or whether the attackers kept continuous access during those two months. Its analyst Dick O'Brien nevertheless considers it “reasonable to assume,” given the nature of the targets, that defense information was being sought, The Record reports. According to Symantec, the intrusion may still be ongoing.

What to do if you work in defense

There is no exotic vulnerability here: an opened attachment was enough. Symantec recommends treating the intrusion as possibly ongoing, not as over, and hunting for credential theft and tunnels, not just the backdoor. A few concrete steps to get there:

• monitor outbound SSH connections from office workstations, which generally have no reason to open any;
• look for traffic to webhook.site and unexpected NTLM authentications to local addresses;
• block macros in documents coming from the internet or received by email;
• search for the indicators published by Symantec, including the address 185.82.218[.]119 (command and SSH server) and the SHA-256 hash of ld.exe: f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff.

This is not the first time Russian hackers have gone after the everyday tools of European organizations: the Roundcube webmail has already paid the price. One question remains unanswered: which countries are affected? Neither Symantec nor the victims have named them.