Reported by 4 outlets

Timeline

1. original reporting

   BlueDelta Targets Defense and Diplomacy with HOOKEDGE

   recordedfuture.com · 48d ago · August 27th, 2026

   Executive Summary Insikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye. The campaigns delivered a lightweight Windows batch-script backdoor, dubbed "HOOKEDGE," via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials. Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). This assessment is based on significant code and tradecraft overlap between HOOKEDGE and the HEADLACE backdoor used in prior BlueDelta campaigns, consistent infrastructure patterns, and targeting consistent with known Russian intelligence collection priorities. HOOKEDGE shares HEADLACE's core architecture, abusing legitimate webhook services for command-and-control (C2), payload staging, and data exfiltration, enabling malicious activity to blend with legitimate network traffic while reducing the operational overhead of dedicated infrastructure. The implant has undergone continuous refinement betwe

2. mentioned by malware.news

   BlueDelta Targets Defense and Diplomacy with HOOKEDGE

   malware.news · 47d ago · August 27th, 2026

3. update from cyberpress.org

   APT28 HOOKEDGE Backdoor Abuses Microsoft Edge and webhook.site for C2 and Data Exfiltration

   cyberpress.org · 46d ago · August 28th, 2026

   BlueDelta is widely associated with Russia’s GRU military intelligence service. The campaign begins with macro-enabled Microsoft Word documents, likely delivered through spearphishing emails. Later documents used generic messages that instructed recipients to click “Enable Content.” Once macros are enabled, the malicious document drops several files into the victim’s user profile directory and starts an installer chain. The installer creates a scheduled task to maintain persistence, then deletes itself and related installation files to reduce evidence on the compromised system. APT28 HOOKEDGE Exploits Edge Webhooks HOOKEDGE is a Windows batch-script backdoor designed to retrieve commands, execute them, and send the results to the attackers. Rather than us

4. update from gbhackers.com

   BlueDelta Targets Defense and Diplomatic Organizations With HOOKEDGE Malware

   gbhackers.com · 46d ago · August 28th, 2026

   The activity, tracked from late September 2025 through early April 2026, relied on macro-enabled Microsoft Word documents and legitimate webhook infrastructure to establish access, execute […] The post BlueDelta Targets Defense and Diplomatic Organizations With HOOKEDGE Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .