Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries

Swallowtail, a Russian espionage group, conducted targeted intrusions against organizations in two NATO member states, focusing on defense and law enforcement sectors. The attackers used malicious Word documents to deliver the Hookedge backdoor. They performed hands-on-keyboard activities, stealing credentials through two methods: deploying SSH private keys to maintain persistent network tunnels and executing PowerShell scripts to capture NTLM authentication handshakes. A novel reflective loader (ld.exe) was used to decrypt payloads in memory dynamically, complicating detection. The operation reflects a broad intelligence-gathering campaign targeting sensitive defense-related information in Europe.

The attackers gained unauthorized persistent access to internal networks of high-value defense and law enforcement targets, enabling credential theft and potential lateral movement. The use of advanced techniques such as reflective loaders and credential harvesting tools increases the difficulty of detection and remediation. The compromise of sensitive information related to naval shipbuilding and military aircraft engine manufacturing poses significant risks to national security and defense capabilities.

No specific patch or remediation is indicated for this espionage campaign. Organizations should focus on detecting and blocking malicious Word documents, monitoring for unusual SSH key deployments and PowerShell activity, and employing endpoint detection capable of identifying reflective loaders. Since this is an active espionage campaign, enhanced network segmentation and credential protection measures are recommended. Vendor or official advisories were not provided; therefore, patch status is not applicable.