Reported by 2 outlets
Russian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across Europe
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Russian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across Europe
gbhackers.com · 38d ago · September 5th, 2026
Russian state-sponsored threat actor BlueDelta, also tracked as APT28, Fancy Bear, and Forest Blizzard, has deployed a lightweight Windows backdoor named HOOKEDGE in espionage operations targeting government, diplomatic, and defense-manufacturing organizations across Europe. The activity, documented by PolySwarm, targeted entities in Romania, Spain, and Turkey between late September 2025 and early April 2026. New variants […] The post Russian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across Europe appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Russian APT28-Linked Hackers Deploy HOOKEDGE Backdoor in European Espionage Attacks
cyberpress.org · 38d ago · September 5th, 2026
Researchers linked the activity to targets in Romania, Spain, and Turkey, with campaign activity observed from late September 2025 through early April 2026 and newer variants emerging during June and July 2026. According to Polyswarm , BlueDelta delivered HOOKEDGE through spearphishing attachments containing macro-enabled Microsoft Word documents. Russian APT28-Linked Hackers Deploy HOOKEDGE Backdoor Early lures used diplomatic themes, including a file impersonating material from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes. Later campaigns shifted to generic documents containing junk text or prompts that asked recipients to select “Enable Content.” When a victim enables macros, the document displays a fake Microsoft Word error message while its AutoOpen() routine begins a multi-stage infection process in the background. The macro writes batch, command, VBScript, HTML, and XHTML files into the user profile directory. These components ensure persistence via a Windows Scheduled Task that launches the HOOKEDGE payload at configured intervals. Installation scripts subsequently remove themselves and associated artifacts, limiting evidence available to incident responders . HOOKEDGE operates as a p