Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries

    Wednesday, October 21, 2026 In: Threat Research Print

    Date: 10/21/2026

    Severity: High

    Summary

    Swallowtail (APT28/Fancy Bear/Forest Blizzard), a Russian state-linked cyberespionage group, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder, and a military aircraft engine manufacturer. During a two-month intrusion at the naval shipbuilder, attackers used the Hookedge backdoor to steal credentials, establish a persistent SSH tunnel, and maintain access to the internal network. They also deployed a previously undocumented loader, ld.exe, which decrypts and executes payloads in memory using a key supplied at runtime.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    https://webhook.site/890efd8d-6e9e-428a-bcf9-987745d71000

    https://webhook.site/53379b62-8020-41cf-af57-effa6e1e8506

    https://webhook.site/5b73dc69-d765-4440-a4d2-e9eb33283eb9

    https://webhook.site/d828b9fc-5435-4b1c-881f-d6350c11d0b6

    https://webhook.site/ca3c058e-3c88-449b-8299-822cd5d5e17c

    IP Address

    185.82.218.119

    Hash

    4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303

    e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8

    e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe

    60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3

    1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e

    a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd

    6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f

    c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44

    ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb7

    5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645

    49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495

    39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b

    1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335

    e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c

    2fceca3460a35eea2b21c47d73c27c27edae95d2ae29ffb4ec2222d1a223b4bd

    68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7

    a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13

    063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543

    d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40

    aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e

    f1cc91e7427a22027f65d31bbee19c54b602d08d7d93e4745b9cea59fa8132ff

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection  

    Detection Query 1 :

    domainname like "https://webhook.site/53379b62-8020-41cf-af57-effa6e1e8506" or url like "https://webhook.site/53379b62-8020-41cf-af57-effa6e1e8506" or siteurl like "https://webhook.site/53379b62-8020-41cf-af57-effa6e1e8506" or domainname like "https://webhook.site/d828b9fc-5435-4b1c-881f-d6350c11d0b6" or url like "https://webhook.site/d828b9fc-5435-4b1c-881f-d6350c11d0b6" or siteurl like "https://webhook.site/d828b9fc-5435-4b1c-881f-d6350c11d0b6" or domainname like "https://webhook.site/ca3c058e-3c88-449b-8299-822cd5d5e17c" or url like "https://webhook.site/ca3c058e-3c88-449b-8299-822cd5d5e17c" or siteurl like "https://webhook.site/ca3c058e-3c88-449b-8299-822cd5d5e17c" or domainname like "https://webhook.site/5b73dc69-d765-4440-a4d2-e9eb33283eb9" or url like "https://webhook.site/5b73dc69-d765-4440-a4d2-e9eb33283eb9" or siteurl like "https://webhook.site/5b73dc69-d765-4440-a4d2-e9eb33283eb9" or domainname like "https://webhook.site/890efd8d-6e9e-428a-bcf9-987745d71000" or siteurl like "https://webhook.site/890efd8d-6e9e-428a-bcf9-987745d71000" or url like "https://webhook.site/890efd8d-6e9e-428a-bcf9-987745d71000"

    Detection Query 2 :

    dstipaddress IN ("185.82.218.119") or srcipaddress IN ("185.82.218.119")

    Detection Query 3 :

    sha256hash IN ("a92413d4951a28822ec85e5c0d1948d4160b91388c5f3d86504611fc286a4d13","1bff55104206d3f55cd72ca58ffecd2fa620a428c5a3c6987d3c4cc68285d335","68613e232d0893e61ad29906daee2312bd4c4e940f4d0c9e702e7c35a256d0f7","1bb1b27e1695c726c7c1d3d4935f9318afc6f5fd9015d7cf3890f0eb7bf8d47e","c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44","e8be50171436550e1edd8b4946d2adc0870e97465f67526ea252bff0815abcbe","6678049918dda2d5859de0a95e0573fec9496c62bbe72967ae0d3deeb5bda68f","60ef547ebd2f4252e286db762980481b0da23dcd2c84465509735544c0a9c2b3","e068794cf43e381b26c82d746cca107b9f84327a2a8308d5b87ea5529963c4c8","e94402a9886d4433ccad0ced0cd4f22d055d1f0f7e4155dbec992433eb94e00c","5709e5e1496410d4b9ac5a3bd8be3ec4595f881b4865ebf6e490784b56105645","4a43aacffc2d8d76f7abac729238779b6c99b10ee09f54c2cea1654a91561303","d74c65e6d35d3b2a80686f059590f919316ecaf4ed539192e904d675ba5c7a40","aafbc096e20f259df9166f837d0baf7333f177e6f383ca7cb9215936ecbe7f5e","49e276498fc4e7d65ebf9fa2acf64ec2a0c25e75ac621cd6a203d64fb75aa495","a3b44405112e6364447e5d96630edfabcf81e5ad37d690c3ebc73770d62aeabd","ea525336b787c2fd3dbc4b3e9a3a78f71004e1bd43e2e1ed953edad51118cb7","39d21c1b8ab2f08c75a1cb7d18433a8b207c71ec1d266bb049b54b7eaf01d67b","2fceca3460a35eea2b21c47d73c27c27edae95d2ae29ffb4ec2222d1a223b4bd","063930af6a4aad06d8f8aab43226bf6dcddd2c79aa505894ee95876cf9254543")

    Reference:  
    APT28 Cyberespionage Campaign                                                          


    Tags

    MalwareThreat ActorAPT28APTFancy BearForest BlizzardRussiaCyber EspionageNATOGovernment Services and FacilitiesDefense Industrial BaseBackdoorCredential HarvestingLoader

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.