Summary
- Broadcom links targeting of three unnamed organisations in two NATO countries to Swallowtail, also known as APT28.
- A naval shipbuilder suffered a compromise lasting at least two months, involving credential theft, Hookedge and an SSH tunnel.
- Investigators identified a new memory loader but did not recover its encrypted payload or establish what information was taken.
Broadcom researchers have linked cyber espionage activity targeting a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement organisation in two NATO member states to the Russian-linked group Swallowtail, also tracked as APT28, Fancy Bear and Forest Blizzard. Their 20 October report provides a detailed forensic account of the shipbuilder compromise, which lasted at least two months.
The clearest forensic sequence comes from the shipbuilder. Investigators found the Hookedge backdoor, attempts to obtain authentication material, a persistent remote tunnel into the internal network and a previously undocumented loader capable of executing decrypted content in memory. The tool expanded the set of mechanisms the attackers could use after initial access.
The other reported targets — a law enforcement organisation and a manufacturer of military aircraft engines — also handle information relevant to defence or government activity. Broadcom has not named the organisations or the two NATO member states, and its public account does not provide the same detailed intrusion timeline for those networks. The shipbuilder findings cannot simply be extended to all three targets.
The most complete evidence concerns the naval shipbuilder. Investigators traced the initial infection to a malicious macro-enabled Word document opened from an Outlook attachment cache on 24 July 2026. Hookedge then used an unusual delivery mechanism involving a hidden Microsoft Edge process and a webhook service to exchange tasks and their results. The attack did not stop at installation of the original backdoor: the investigators observed subsequent commands showing operators actively exploring and maintaining access.
By 27 July, the attackers were using a separate dedicated server to issue further instructions. Broadcom describes attempts to obtain credential material through more than one route, alongside discovery of internal hosts, system configuration and installed security updates. The operators also created an SSH tunnel from the victim environment towards infrastructure under their control. Such a connection can offer a pathway back into a network while reducing the need to repeat the initial intrusion sequence.
The researchers observed further activity towards the end of July, including deployment of a tool named ld.exe. Its code was designed to accept an encrypted file and a decryption key, load the resulting content directly into memory, and execute it. That design can reduce the exposure of an unencrypted second-stage program on disk. In this case, the encrypted file itself was not recovered, and the research does not establish whether it performed credential theft, surveillance or another function.
Evidence of the initial launcher and the newly observed tool persisted beyond the operators’ most active period. Broadcom recorded the latest launcher activity on 24 September, following the first observed infection on 24 July. The dates support a compromise spanning at least two months, but they do not establish that an operator was issuing new instructions throughout that entire period; some later events could reflect previously installed mechanisms.
Swallowtail has previously been associated with Russia’s military intelligence service, the GRU, by US government authorities. That established attribution history provides context for Broadcom’s assessment but is distinct from a public account of the specific intelligence collected in the incidents under examination. Nor does the presence of a tool previously used by the group establish the full chain of tasking, access and exfiltration for every victim.
The selection of defence manufacturing and law enforcement organisations is consistent with an intelligence-gathering campaign. Shipbuilders and aircraft engine suppliers can hold design, procurement, production and partner information, even where their networks are separate from classified government systems. Broadcom does not report which of those materials were accessible or taken from these victims, so potential sensitivity must not be turned into a confirmed exfiltration claim.
Credential access and an independently established tunnel complicated the shipbuilder’s exposure beyond the original malicious document. Removing the first backdoor would not, by itself, demonstrate that stolen authentication material could no longer be used or that the secondary access path had closed. The separate mechanisms account for why the investigation extends well beyond the delivery document.
Broadcom’s 20 October investigation documents hands-on intrusion activity at the naval shipbuilder, with a previously unreported loader added to known Hookedge techniques. It also identifies two further NATO-linked targets without naming them. The public evidence establishes an espionage intrusion and persistence mechanisms at the shipbuilder, but not the total volume or type of information obtained.
