APT28 targets NATO defense firms with Hookedge backdoor; Tor exits hijacked for SSH harvesting

1. Executive summary

Symantec has attributed attacks on a law enforcement agency, a naval shipbuilder and a military aircraft engine manufacturer in two NATO member states to APT28 (MITRE G0007, tracked by Symantec as Swallowtail), using a previously undocumented loader that decrypts and runs a backdoor called Hookedge in memory. At the shipbuilder the intrusion lasted at least two months, with credential theft by two techniques and a persistent SSH tunnel into the internal network. Separately, a researcher found 333 Tor# Advisory AT-2026-10-23-1502: APT28 targets NATO contractors with Hookedge backdoor; Ebury-linked Tor exit relays harvested SSH credentials

1. Executive summary

Symantec has attributed attacks on a law enforcement agency, a naval shipbuilder and a military aircraft engine manufacturer in two NATO member states to APT28 (MITRE G0007, tracked by Symantec as Swallowtail), using a previously undocumented loader that decrypts and runs a backdoor called Hookedge in memory. At the shipbuilder the intrusion lasted at least two months, with credential theft by two techniques and a persistent SSH tunnel into the internal network. Separately, a researcher found 333 Tor exit relays redirecting SSH connections to a dozen attacker-controlled servers that captured passwords and then attempted to infect the destination hosts with Ebury. Neither item names a CVE, and no CVSS score, severity rating or CISA KEV entry applies to either. For EMEA financial services the exposure is indirect but concrete: SSH credential reuse and Tor-routed administrative access are common in outsourced infrastructure and managed-file-transfer estates, and a compromised SSH credential into a payment-adjacent host is a recognised precursor to fraud and data theft.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The APT28 activity is a targeted intrusion against defence-industrial targets, not a vulnerability with a patch. The source gives no initial access vector, no exploited component and no CVE. What it does give is the post-compromise sequence at the naval shipbuilder, which is the part a defender can act on.

Confirmed steps at the shipbuilder, per Symantec as reported:

1. The attackers gained a foothold and remained undetected for at least two months.
2. They stole credentials using two different techniques. The source does not name the techniques.
3. They opened a persistent SSH tunnel into the internal network.
4. They deployed a previously undocumented loader that decrypts and runs its payload in memory, delivering the Hookedge backdoor.

The in-memory loader is the significant detail. A payload that is decrypted and executed in memory leaves no dropped executable on disk for file-based antivirus to catch, so detection has to come from process behaviour, memory scanning or network egress rather than from a file hash. The source provides no hash, no filename, no C2 address and no registry or file-system artefact for Hookedge. The persistent SSH tunnel is the other actionable fact: it implies the intruders held valid SSH credentials and used them to hold a channel into the internal network, which is exactly the pattern the Tor/Ebury item below also exploits.

The Tor exit relay activity is a separate campaign with a shared theme. A researcher whose own SSH session was intercepted while using Tor found that 333 exit relays, roughly a tenth of all exits, were redirecting SSH connections to a dozen attacker-run servers. Those servers captured the passwords of users who ignored SSH's host-key warning and proceeded to log in. The relays ran on servers already compromised with Ebury, and their exit policies had been altered to block encrypted email retrieval ports and allow plaintext ones. After capturing a password the attackers tried to infect the server the victim was logging into with Ebury. The Tor Project removed the relays within three days. One affected operator traced its own breach to a reused password. The Tor Project did not respond to SecurityWeek's request for comment.

The mechanism matters for defenders: SSH prints a changed-host-key warning when a server's key does not match what the client last saw. A user who types "yes" past that warning hands the password to the relay. The relay then uses the captured credential against the real destination. Reused passwords turn a single intercepted session into a breach of the destination host.

Confidence caveats. The APT28 attribution is Symantec's, reported by SecurityWeek; it is single-sourced to that vendor and has not been independently corroborated in the material available here. The Tor/Ebury findings rest on one researcher's investigation as reported by SecurityWeek, also single-sourced. Neither the Hookedge loader nor the Ebury relay infrastructure has published atomic indicators in this reporting. Treat both as leads to hunt against, not as confirmed IOCs to block.

4. Mitigation & containment

P1 within 24 hours

• Hunt for SSH tunnels originating from servers that should not be initiating outbound SSH. On Linux hosts, review sshd and outbound ssh process ancestry and check ~/.ssh/authorized_keys and ~/.ssh/known_hosts for unexpected entries on any host with internet-facing SSH.
• Enforce SSH host-key verification. Push a managed known_hosts via configuration management and set StrictHostKeyChecking yes in client config so a changed host key fails closed rather than prompting. This directly defeats the Tor exit relay interception.
• Rotate any SSH credential that has been used over Tor or from an untrusted network in the last 90 days, and check for password reuse against internal hosts. The one confirmed breach in the source was traced to a reused password.
• Block outbound SSH from server subnets that have no business reason to initiate it, at the egress firewall. The shipbuilder's persistent tunnel required outbound SSH from an internal host.

P2 within 72 hours

• Inventory SSH trust: list every authorized_keys entry across the estate and remove keys that cannot be tied to a named owner and purpose.
• Add EDR or host monitoring for in-memory payload execution: alert on processes that allocate and execute memory without a corresponding file on disk, and on unusual parent-child chains around SSH daemons.
• Review Tor exit usage policy. If staff or automated jobs route administrative traffic over Tor, stop it; the source shows the exit path is actively hostile.

P3 within 7 days

• Move administrative SSH to certificate-based authentication with short-lived certificates rather than static passwords, removing the reusable secret the relay campaign depends on.
• Tabletop the APT28 scenario against your own defence-supply-chain and managed-file-transfer providers, since the source targets exactly that industrial profile.

No vendor fix or patch is named in the source because no CVE is involved. Remediation here is configuration and credential hygiene, not version pinning.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe behaviour but publish no hashes, domains, IP addresses, filenames or registry keys for Hookedge or the Ebury relay infrastructure.

Behavioural indicators

6. Detection

The source gives no file artefacts, command-line flags, mutex names or hard-coded strings for Hookedge or Ebury, so a string-based YARA rule cannot be built without fabricating content. Detection has to rest on behaviour.

title: Outbound SSH Tunnel from Internal Server
id: 8f3c2a10-6b7e-4d21-9a55-1c0e7b4f2d90
status: experimental
description: Detects an internal server initiating an outbound SSH connection, consistent with the persistent SSH tunnel reported in the APT28 Hookedge intrusion.
author: Adverse Trace
date: 2026-10-23
references:

  - https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware/
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/ssh'
  selection_args:
    CommandLine|contains:

      - ' -R '
      - ' -L '
      - ' -D '
  filter_mgmt:
    ParentImage|endswith:

      - '/cron'
      - '/systemd'
  condition: selection_img and selection_args and not filter_mgmt
fields:

  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:

  - Legitimate administrative tunnelling; tune to known bastion hosts
level: high

title: SSH Host Key Change Accepted by Client
id: 2d9b6e44-1a3f-4c88-b7e2-5f0a9c3d1e67
status: experimental
description: Detects an SSH client proceeding after a host key mismatch, the condition the Tor exit relay campaign relied on to capture passwords.
author: Adverse Trace
date: 2026-10-23
references:

  - https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware/
logsource:
  product: linux
  service: auth
detection:
  selection:
    message|contains:

      - 'REMOTE HOST IDENTIFICATION HAS CHANGED'
      - 'Host key verification failed'
  condition: selection
fields:

  - user
  - hostname
  - message
falsepositives:

  - Legitimate server rebuilds or key rotation
level: medium

Threat actor context

APT28 · G0007 · aka IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. …

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

No MITRE ATT&CK profile for: NSO Group.

7. Sources

• SecurityWeek, "In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware", 2026-10-23. https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware/
• Symantec research on APT28 (Swallowtail) and the Hookedge backdoor, as reported by SecurityWeek in the item above. No standalone Symantec publication URL was provided.

8. Adverse Trace position

Adverse Trace assesses the APT28 Hookedge activity as a targeted intrusion against defence-industrial contractors with no assigned CVE, CVSS score or CISA KEV entry, so it does not map to a patch cycle; the risk to EMEA financial services is second-order, through shared SSH and administrative infrastructure rather than direct targeting. The Tor/Ebury relay campaign is the more immediately relevant item for most clients because it turns ordinary SSH password reuse into credential compromise, and reused administrative passwords are common in outsourced estates. Both findings are single-sourced (Symantec via SecurityWeek; one researcher via SecurityWeek) and carry no published atomic indicators, so we will not issue blocklists on this basis. We will monitor for a standalone Symantec publication with Hookedge hashes and C2 detail, and for any follow-on reporting that names the Ebury relay infrastructure, and will reissue with IOCs if those appear. Clients running internet-facing SSH should treat the P1 host-key enforcement and credential rotation steps as actionable now regardless of the attribution caveat.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.