Item 6 in the brief for Wed, Oct 21

APT28 hit a NATO shipbuilder and engine maker with Hookedge, Symantec says

Symantec says Swallowtail, the Russian espionage group also known as APT28 and Fancy Bear, targeted organizations in two NATO countries. They were a law enforcement agency, a naval shipbuilder and a maker of military aircraft engines. At the shipbuilder, an intrusion that began with a Word attachment lasted at least two months. The operators stole credentials two ways, opened a persistent SSH tunnel to their own server and deployed a previously undocumented loader.

Versions: Not applicable: no software flaw is involved.
Vendor: Microsoft
Published: Oct 21, 6:00 a.m. ET
Editor: Austin Simas

Details

The Hookedge backdoor, first documented by Recorded Future in August, arrives in macro-enabled Word documents and takes its tasks through the webhook[.]site service. Infected hosts fetch tasks with a hidden, off-screen Microsoft Edge window rather than a downloader. At the shipbuilder, a second-stage component switched to the attackers’ own server, , for tasking and stealing data.

The operators pushed an SSH private key to the host and opened a backgrounded tunnel from their server into the internal network. They also ran a PowerShell script that makes the host sign in to its own loopback listener, capturing an NTLM handshake that can be cracked offline or relayed.

The new loader, ld.exe, takes an encrypted file and a key on its command line, decrypts the file in memory and runs it. Symantec didn’t recover the payload, so what it does is unknown. The loader and the launcher were still on the host in late August, and the launcher was seen again on Sep 24.

Symantec says organizations that find Hookedge indicators should treat the intrusion as possibly ongoing and look for credential theft and tunneling, not just the backdoor.

What to do

5 steps

1Search proxy and firewall logs for and the webhook[.]site URLs in the indicators table, which Symantec lists as network indicators.
2Search endpoint logs for msedge.exe started with --window-size=1,1 and --window-position=10000,10000, the hidden window Hookedge uses to fetch tasks.
3Search for ssh.exe opening outbound connections with -R remote forwarding, as the operators did to their server on port 80, and for private keys dropped under C:\ProgramData.
4Search endpoints for the file hashes in the indicators table, including ld.exe, the loader that runs an encrypted file with a key passed on its command line.
5Treat any Hookedge finding as a possibly ongoing intrusion and look for credential theft and SSH tunneling, as Symantec advises.

Indicators

IPs and URLs copy defanged. Use Copy raw for queries.

Type	Value	Note
IP address		Attackers’ server for tasking, data theft and the SSH tunnel
URL		Hookedge tasking endpoint on a legitimate service
URL		Hookedge endpoint on a legitimate service
URL		Hookedge endpoint on a legitimate service
URL		Hookedge endpoint on a legitimate service
URL		Hookedge endpoint on a legitimate service
SHA-256		ld.exe, the reflective loader
SHA-256		Hookedge VBS launcher
SHA-256		Hookedge VBS launcher
SHA-256		Hookedge VBS launcher
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper
SHA-256		Hookedge dropper

IP addressAttackers’ server for tasking, data theft and the SSH tunnel
URLHookedge tasking endpoint on a legitimate service
URLHookedge endpoint on a legitimate service
URLHookedge endpoint on a legitimate service
URLHookedge endpoint on a legitimate service
URLHookedge endpoint on a legitimate service
SHA-256ld.exe, the reflective loader
SHA-256Hookedge VBS launcher
SHA-256Hookedge VBS launcher
SHA-256Hookedge VBS launcher
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper
SHA-256Hookedge dropper

Timeline

Jul 24A Word attachment opened at the shipbuilder installs Hookedge.
Jul 27A second stage starts taking tasks from the attackers’ own server.
Jul 31The operators run the ld.exe loader.
Sep 24Symantec sees the Hookedge launcher on the host for the last time.
Oct 20Symantec publishes its findings and indicators.

Sources

Symantec Threat Hunter TeamPrimary source security.com