Adversary Intelligence — 2026-08-31

Russian APT28 Deploys New HOOKEDGE Backdoor Targeting European Defense and Diplomatic Organizations via Macro-Enabled Documents

BLUFBlueDelta's pivot to legitimate web services for command routing degrades network-based detection of GRU operations against NATO-adjacent targets and compels a shift to behavioral analytics.

Recorded Future's Insikt Group reported that BlueDelta, a Russian GRU-linked group overlapping with APT28, Fancy Bear, and Forest Blizzard, ran initial-access campaigns against government, diplomatic, and defense-manufacturing organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026, with campaign refinement continuing into June 2026 1. The group delivered a new backdoor, HOOKEDGE, through macro-enabled Word documents, including one lure impersonating a Spanish Ministry of the Presidency meeting agenda created shortly after a September 2025 meeting between Spanish and Moldovan officials; later lures embedded hidden tracking images that alerted operators when a document or its delivery email was opened, before any payload deployed 12. Insikt Group assessed with moderate confidence that HOOKEDGE is a direct evolutionary successor to BlueDelta's earlier HEADLACE backdoor, citing shared batch-scripting code and identical JavaScript variable names and encoding schemes 13. HOOKEDGE routes command tasking and data exfiltration through webhook.site and hidden Microsoft Edge browser sessions, checking in every 30 minutes by default, with a faster five-minute interval deployed against select higher-value victims; a 100-request-per-endpoint cap on webhook.site's free tier drove this tiered design, and operators administered infrastructure from NordVPN IP addresses 124. The Hacker News and Security Affairs corroborated Insikt Group's findings without independent reporting 34.

Analysis
BlueDelta's pivot from custom C2 to webhook.site and hidden Edge sessions strips the network-based indicators defenders have relied on to flag GRU tooling, pushing detection toward behavioral signals: scheduled tasks from user-writable folders, headless browser automation, unsanctioned webhook traffic. The tiered 30-minute/five-minute beaconing split points to sustained Russian prioritization of NATO-adjacent diplomatic engagement, particularly Moldova-related matters, and seven months of lure and check-in refinement reflects an operationally mature unit iterating against detection rather than piloting a new tool. Insikt Group, the sole primary source, assesses with moderate confidence that HOOKEDGE evolved directly from BlueDelta's HEADLACE backdoor based on shared batch-scripting code and identical JavaScript variable names and encoding; overlap with Lab52-tracked Operation MacroMaze suggests the tooling may instead be shared across multiple GRU-linked clusters rather than developed exclusively by BlueDelta. Disclosed webhook GUIDs and file hashes carry limited shelf life given the group's demonstrated infrastructure-rotation pattern between waves.

4 sources

BlueDelta Targets Defense and Diplomacy with HOOKEDGE - Recorded Future
Russian Hackers Use New HOOKEDGE Malware to Spy on European Defense and Diplomatic Targets - Cyber Security News
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations - The Hacker News
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations - Security Affairs