APT28 deploys ld.exe reflective loader and persistent SSH tunnel at NATO naval shipbuilder

Symantec's Swallowtail cluster report details delivery of updated HOOKEDGE variants via macro documents that pivot from webhook[.]site to hardcoded IP 185.82.218[.]119:443. Operators executed an SSH private-key push followed by a loopback NTLM capture script, then dropped ld.exe via curl over the tunnel. The loader decrypts its payload in memory using a runtime key, matching code patterns Recorded Future previously linked to HEADLACE implants active since 2023.

The shipbuilder targeting aligns with earlier APT28 operations against Romanian, Spanish, and Turkish diplomatic entities reported by Insikt Group in August 2026. CERT-UA's September 2026 bulletin on Russian smartphone compromises in Ukraine shows parallel credential-harvesting tradecraft now migrating into defense contractors. No public CVSS or exploit data exists for ld.exe, yet the hands-on persistence over seven days indicates pre-positioning for supply-chain access rather than immediate data exfiltration.

Official attribution rests solely on Symantec's cluster matching; independent technical confirmation of Russian state control remains limited to code reuse and infrastructure overlap. The pattern reveals sustained interest in European naval manufacturing nodes that feed NATO fleets, extending beyond the original Hacker News summary which omitted the tunnel's operational implications.

Defense contractors should expect continued use of in-memory loaders and SSH persistence in Q4 2026, with procurement records showing increased Russian interest in shipyard subcontractors.