Loading story…
Russian state-linked operators used the HOOKEDGE Windows backdoor in spearphishing campaigns against diplomatic, government, and defense-related organizations in Romania, Spain, and Turkey. Malicious emails carried macro-enabled Microsoft Word attachments whose hidden scripts deployed a multistage installer after recipients enabled content; the malware then created scheduled tasks for persistence.
HOOKEDGE launches concealed Microsoft Edge instances to poll attacker staging infrastructure, including webhook.site, retrieve commands, and exfiltrate collected results over HTTPS through separate hidden browser sessions. Recorded Future attributed the activity to the GRU-associated BlueDelta/APT28 group with moderate confidence, assessing HOOKEDGE as an evolution of HEADLACE; operators also varied lures, VBA obfuscation, execution methods, and beacon intervals—including a 61-minute delay—to complicate detection and sandbox analysis while removing temporary artifacts.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
A threat-research report published webhook.site command-and-control and exfiltration URL paths, 26 SHA-256 hashes, and detection queries for identifying HOOKEDGE activity attributed to BlueDelta/APT28.
Recorded Future linked the HOOKEDGE activity to the GRU-associated BlueDelta group, also tracked as APT28, Fancy Bear, and Forest Blizzard, with moderate confidence. Researchers assessed HOOKEDGE as an evolution of the earlier HEADLACE backdoor and documented changes to lures, VBA obfuscation, Edge execution, and beacon intervals.
Russian operators used the HOOKEDGE Windows backdoor in spearphishing-led espionage operations against diplomatic, government, and defense-related organizations in Romania, Spain, and Turkey. The campaign established scheduled-task persistence, used hidden Microsoft Edge instances and webhook.site for command retrieval and exfiltration, and removed temporary artifacts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 49 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian GRU-linked espionage group **BlueDelta**—also tracked as APT28, Fancy Bear, and Forest Blizzard—targeted government, diplomatic, and defense-manufacturing organizations in Romania, Spain, and Türkiye from late September 2025 through early April 2026. The group used macro-enabled Microsoft Word lures, including documents impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, to gain initial access and deploy the Windows batch-script backdoor **HOOKEDGE**. HOOKEDGE substantially overlaps with BlueDelta’s earlier HEADLACE implant and uses `webhook[.]site` for command-and-control, payload staging, and data exfiltration. Operators refined lure themes, execution techniques, and beaconing cadence during the activity, using more frequent second-stage callbacks for higher-value targets; defenders should block macros in internet-originated documents and monitor for scheduled-task abuse, headless Microsoft Edge processes, and outbound webhook-service connections.
Sep 4, 2026
The Russia-linked **Gamaredon** threat group, also tracked as **ACTINIUM**, **Primitive Bear**, **Shuckworm**, and **Aqua Blizzard**, has been tied to sustained spearphishing operations against Ukrainian government and state institutions. Reporting describes lure documents delivered through spoofed or compromised email accounts, with infection chains using remote template injection, **VBA macros**, and malware components including **GammaDrop**, **GammaLoadIdentifier**, and the custom backdoor **Pteranodon**. Researchers said the activity remained ongoing across multiple waves and was aimed at gaining initial access and maintaining footholds inside targeted environments. Technical analysis linked the campaign to abuse of **`CVE-2025-8088`**, startup-folder **VBScript** persistence, changes to Microsoft Word macro security registry settings, host identifier collection, and HTTP-based command-and-control communications over dynamic DNS-hosted infrastructure. Separate infrastructure research expanded on previously reported Gamaredon/ACTINIUM network assets by using passive DNS pivots, identifying domain and subdomain patterns, shared IP reuse, and additional likely attacker-controlled **`.ru`** domains consistent with the group’s broader operational infrastructure.
Aug 15, 2026
A **Russia-linked cyber-espionage campaign** targeted Ukrainian entities with a JavaScript-based backdoor called **DRILLAPP**, using lures themed around **Starlink terminal verification** and the **Come Back Alive Foundation** charity. Researchers linked the activity to **Laundry Bear**—also tracked as **Void Blizzard** and **UAC-0190**—and said the operation shared tradecraft with earlier campaigns against Ukrainian defense-related targets. The malware was observed in February 2026 and was designed for surveillance and remote access, including file upload and download, microphone recording, and webcam image capture. The intrusion chain used malicious **LNK** files to create an **HTA** file in a temporary directory, fetch obfuscated scripts from **Pastefy**, and establish persistence by copying shortcuts into the Windows Startup folder. The payload then executed through **Microsoft Edge** in headless mode with permissive flags such as `--no-sandbox`, `--disable-web-security`, `--allow-file-access-from-files`, `--use-fake-ui-for-media-stream`, and `--disable-user-media-security`, enabling access to the local file system, camera, microphone, and potentially screen capture without normal user prompts. Researchers said the browser-based approach likely helps the attackers blend malicious activity with legitimate browser access to sensitive device features.
Jun 29, 2026