PENTESTY · EDITORIAL ANALYSIS · · 4 min read
HOOKEDGE: who confirms the access tunnel has closed?
A session marked complete in a ticket may remain open in the infrastructure. Check the existing connection, new attempts and internal reach before accepting closure.
By Pentesty
The published investigation and its limits
This analysis was prompted by Cyber Security Brazil’s report. On October 20, Symantec and Carbon Black attributed a HOOKEDGE intrusion at a shipbuilder in a NATO member country to Swallowtail, also called APT28. They described a persistent SSH tunnel, July activity and artifacts through September. They did not report intrusion into alliance systems. The purpose of the encrypted payload associated with loader ld.exe remained unknown.
Give the connection a direction, purpose and owner
OpenSSH documentation describes TCP forwarding through authenticated channels. For a business, this calls for recording the channel’s authorized effect. A rule allowing a workstation to communicate with a server needs to connect that communication with its purpose and the resources the path can reach.
Choose a legitimate maintenance task and draw its path: initiating workstation, intermediary server, identity used and internal destination service. Record who may change that path. The refrigeration remote-access review helps define owners and operational boundaries; the focus here is proving closure of a path created from the workstation.
Define the expected outcome before disconnecting
Agree with operators on the task and its closure. Abruptly closing a channel can interrupt approved work. Describe the maintenance window, permitted destinations, stopping condition and an alternative way to finish the task without expanding access.
Distinguish authorization, the credential and the process maintaining communication. Decide who confirms closure for each. A completed ticket should point to technical evidence, including dependencies left for another team and the owner responsible for that handoff.
Compare the open session, a new connection and the internal destination
Prepare an authorized laboratory with two controlled machines, a known maintenance integration and a fictional service representing the internal destination. Use an identity dedicated to the exercise. The network owner should approve the path, synthetic content and stopping conditions before testing begins, with responsibilities and expected observations recorded.
Exercise only the agreed legitimate function. Then follow the approved closure procedure and observe the outcomes below separately. The team can begin with a tabletop exercise if collection requirements or the impact of active validation have not yet been defined. Record that choice as a limitation of the evidence delivered.
- Existing session: record the process, observed connection and outcome after closure.
- New connection: verify what happens during a later attempt using the test identity.
- Internal destination: check whether the fictional service remains reachable through the assessed path.
- Continuity: verify the task that must remain available and remove temporary resources.
Give each remaining access path its own evidence
If communication continues, record what the observation demonstrates and refer it to the owner able to act. An active process, unexpected configuration or a visibility gap may need investigation. Keep the question open until the mechanism is understood; an isolated indicator does not determine attribution or impact.
The ConnectWise incident-response analysis examines another situation requiring investigation of additional access. In this exercise, connect the decision with the specific process, identity and destination. Where evidence suggests a real compromise, follow incident-response procedures while preserving available records and assigning ownership of the next investigation step.
Accept closure with coverage clearly stated
Deliver a record containing the approved path, completed procedure and observations before and after closure. State collection limits, discrepancies and the acceptance owner. Another reviewer should be able to understand which access ended and which condition still needs confirmation before the task can be considered complete.
Repeat the sample when maintenance software, credentials, the intermediary or network rules change. Validation covers that path under the tested conditions. It should also confirm that legitimate work still functions, so the correction does not depend on a permanent exception without an accountable owner or a condition for its review.
Frequently asked questions
Does the case confirm that NATO systems were breached?
The investigation describes a shipbuilder located in a member country. It does not establish intrusion into alliance systems or publicly identify the affected organization.
Can an outbound connection provide internal access?
Authorized forwarding can carry connections to other destinations. Review the channel’s effective direction and reach, the identity involved and its approved purpose.
Does completing the ticket prove the session ended?
Closure needs evidence about the existing connection and a later attempt. Also verify reach to the internal destination within the authorized scope.
Must we execute HOOKEDGE to validate this process?
The proposed exercise uses known tools, controlled machines and fictional data. It requires no malware, collection of real credentials or connection to campaign infrastructure.
Sources and references
- Symantec and Carbon Black: October 20, 2026 Swallowtail investigation
- OpenSSH: channel and TCP-forwarding documentation
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 21, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.