Swallowtail (APT28) and HOOKEDGE: Attacks on Two NATO Countries and a Defender Checklist

Symantec and Recorded Future documented coordinated HOOKEDGE backdoor activity attributed to APT28/Swallowtail that used macro-enabled Word documents and webhook.site as a control channel to target NATO-country organizations (law enforcement, naval shipbuilder, aircraft engine maker). The reports map the full attack chain—email lure, dropped scripts, hidden headless Edge, scheduled tasks, SSH tunnels, NTLM capture and a reflective loader (ld.exe)—provide IOCs (hash f1cc91e7..., IP 185.82.218.119, webhook addresses) and offer a concise detection/mitigation checklist (block internet macros, monitor webhook.service traffic, alert on odd Edge launches, hunt scheduled tasks, SSH usage and NTLM self-capture).