Loading story…
Russian GRU-linked espionage group BlueDelta—also tracked as APT28, Fancy Bear, and Forest Blizzard—targeted government, diplomatic, and defense-manufacturing organizations in Romania, Spain, and Türkiye from late September 2025 through early April 2026. The group used macro-enabled Microsoft Word lures, including documents impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, to gain initial access and deploy the Windows batch-script backdoor HOOKEDGE.
HOOKEDGE substantially overlaps with BlueDelta’s earlier HEADLACE implant and uses webhook[.]site for command-and-control, payload staging, and data exfiltration. Operators refined lure themes, execution techniques, and beaconing cadence during the activity, using more frequent second-stage callbacks for higher-value targets; defenders should block macros in internet-originated documents and monitor for scheduled-task abuse, headless Microsoft Edge processes, and outbound webhook-service connections.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Recorded Future observed additional HOOKEDGE variants in June and July 2026 after the previously documented campaign period. July samples removed the document-open canary, reflecting a subsequent change to BlueDelta's lure-tracking mechanism.
The earliest identified lure was observed on September 26, 2025. It impersonated a September 15 meeting agenda from Spain's Ministry of the Presidency, Justice and Relations with the Cortes.
Across the September 2025 to April 2026 campaign period, BlueDelta changed lures, execution methods, and beaconing intervals, including a faster-beaconing second-stage payload for targets assessed as higher intelligence value. HOOKEDGE used webhook[.]site for command and control, payload staging, and data exfiltration.
From late September 2025 through early April 2026, the GRU-linked BlueDelta group used macro-enabled Word documents to deploy the HOOKEDGE batch-script backdoor against government, diplomatic, and defense-manufacturing organizations in Romania, Spain, and Türkiye.
BlueDelta previously used its HEADLACE backdoor in initial-access campaigns targeting organizations across Europe.
Technical reporting disclosed HOOKEDGE canary webhook paths used to record email and document opens, along with payload artifact names, webhook endpoints, and sample hashes associated with the campaign. The reporting also identified a 61-minute first-stage check-in configuration intended to evade one-hour automated analysis windows.
Recorded Future assessed with moderate confidence that the GRU-linked BlueDelta group overlaps with APT28, also known as Fancy Bear and Forest Blizzard. It also assessed HOOKEDGE as an evolutionary successor to BlueDelta's earlier HEADLACE backdoor maintained by the same operators.
Technical analysis found that HOOKEDGE's installer creates a scheduled task that runs every 30 minutes. The backdoor retrieves command-script payloads and returns output through HTTP requests made by hidden or headless Microsoft Edge, then deletes temporary files and terminates processes associated with its task identifier.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcerecordedfuture.com
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian state-linked operators used the **HOOKEDGE** Windows backdoor in spearphishing campaigns against diplomatic, government, and defense-related organizations in Romania, Spain, and Turkey. Malicious emails carried macro-enabled Microsoft Word attachments whose hidden scripts deployed a multistage installer after recipients enabled content; the malware then created scheduled tasks for persistence. HOOKEDGE launches concealed Microsoft Edge instances to poll attacker staging infrastructure, including `webhook.site`, retrieve commands, and exfiltrate collected results over HTTPS through separate hidden browser sessions. Recorded Future attributed the activity to the GRU-associated BlueDelta/**APT28** group with moderate confidence, assessing HOOKEDGE as an evolution of **HEADLACE**; operators also varied lures, VBA obfuscation, execution methods, and beacon intervals—including a 61-minute delay—to complicate detection and sandbox analysis while removing temporary artifacts.
Sep 9, 2026
Russian state-sponsored threat group BlueDelta (also known as APT28, Fancy Bear, and Forest Blizzard) conducted a persistent credential-harvesting campaign against users of UKR.NET, a popular Ukrainian webmail and news service, between June 2024 and April 2025. The campaign involved the use of phishing emails containing PDF lures with embedded links to fake UKR.NET login pages, designed to steal usernames, passwords, and two-factor authentication codes. BlueDelta leveraged free web services such as Mocky, DNS EXIT, ngrok, and Serveo to host these credential-harvesting pages, and used URL shorteners and Blogger subdomains to obfuscate the phishing infrastructure and redirect victims. The operation reflects BlueDelta's adaptive tactics in response to Western-led infrastructure takedowns, with the group continuing to abuse free hosting and anonymized tunneling platforms. While specific targets were not disclosed, the campaign is assessed as part of Russia's broader intelligence-gathering efforts against Ukrainian users, supporting GRU objectives. The tools, infrastructure, and bespoke JavaScript used in this campaign are consistent with BlueDelta's established tradecraft and have not been observed in use by other Russian threat groups.
Jun 29, 2026
Multiple espionage-focused threat clusters have adopted the **BlueMoon** exploit kit, chaining Chromium V8 vulnerabilities, a V8 sandbox escape, and the Windows kernel privilege-escalation flaw `CVE-2026-85880` to gain code execution and elevated privileges. Older Windows 10 and Windows Server 2019/2022 builds are reported to be particularly exposed. The activity begins with phishing and has targeted U.S. NGOs, mining and commodity-trading firms, as well as government, defense, aerospace, manufacturing, financial, and commercial organizations across the United States and Southeast Asia. TA412, also tracked as Violet Typhoon and APT31, was the first identified user and used phishing to install the **GemStone** malicious browser extension. Additional clusters—UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket—have reportedly used the kit to deliver browser-surveillance payloads, ShadowPad, and other loaders. Proofpoint assessed that rapid adoption by several actors, exposed development artifacts, and exploitation during patch gaps suggest a shared exploit-procurement pipeline; AI-assisted development may also have lowered the barrier to weaponizing browser exploits.
Sep 15, 2026