security-com · Crawled Nov 10, 2026
Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries
24 IoCs 1 Actors
Read original article ↗
AI Summary
Swallowtail, a Russian cyberespionage group also known as APT28 or Fancy Bear, conducted a targeted campaign against defense and law enforcement organizations in two NATO countries. The attacks involved the use of the Hookedge backdoor, delivered via malicious Word documents, which communicated through webhook.site and later switched to a dedicated C2 IP. Attackers performed hands-on-keyboard operations, stole credentials using SSH tunneling and NTLM relay techniques, and deployed a previously undocumented reflective loader named ld.exe. The intrusion persisted for at least two months, indicating a sustained espionage effort focused on national security targets.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 24 extracted
| Type | Value | Detail |
|---|---|---|
| SHA-256 | f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff | Details → |
| IP | 185[.]82[.]218[.]119 | Details → |
| Domain | webhook[.]site | Details → |
| Filename | ld.exe | Details → |
| SHA-256 | 4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303 | Details → |
| SHA-256 | e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8 | Details → |
| SHA-256 | e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe | Details → |
| SHA-256 | 60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3 | Details → |
| SHA-256 | 1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e | Details → |
| SHA-256 | a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd | Details → |
| SHA-256 | 6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f | Details → |
| SHA-256 | c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44 | Details → |
| SHA-256 | ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb72 | Details → |
| SHA-256 | 5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645 | Details → |
| SHA-256 | 49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495 | Details → |
| SHA-256 | 39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b | Details → |
| SHA-256 | 1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335 | Details → |
| SHA-256 | e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c | Details → |
| SHA-256 | 2fceca3460a35eea2b21c47d73c27c27edae95d2ae29ffb4ec2222d1a223b4bd | Details → |
| SHA-256 | 68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7 | Details → |
| SHA-256 | a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13 | Details → |
| SHA-256 | 063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543 | Details → |
| SHA-256 | d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40 | Details → |
| SHA-256 | aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e | Details → |
MITRE ATT&CK TTPs 28 techniques
T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1021.004 SSH · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1046 Network Service Discovery · Discovery T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1069 Permission Groups Discovery · Discovery T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1078.004 Cloud Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087 Account Discovery · Discovery T1090 Proxy · Command And Control T1110 Brute Force · Credential Access T1114 Email Collection · Collection T1136.001 Local Account · Persistence T1204.002 Malicious File · Execution T1556.005 Reversible Encryption · Credential Access T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1558.003 Kerberoasting · Credential Access T1566 Phishing · Initial Access