Symantec's Threat Hunter Team uncovered what followed Hookedge delivery at a NATO naval shipbuilder: NTML theft, a persistent reverse SSH tunnel, and a new reflective loader. https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets
www.security.comSwallowtail: Russian Espionage Group Targets Defense Firms in Two NATO CountriesRussian group stole credentials and tunneled into the network during a two-month intrusion at a naval shipbuilder.