APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
Threat actor
BlueDelta
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenAug 27, 2026
- Last mentioned9d ago
Timeline
4 articles · newest firstRussian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
78
BlueDelta Targets Defense and Diplomacy with HOOKEDGE
Recorded Future reports Russian state-sponsored group BlueDelta deploying the HOOKEDGE backdoor against European defense and diplomatic organizations.
72
Appears with
- Recorded Futureorganization · 4
- Hookedgemalware · 4
- APT28threat actor · 3
- Forest Blizzardthreat actor · 3
- Fancy Bearthreat actor · 3
- GRUorganization · 2
- Microsoft Edgeproduct · 2
- Microsoft Wordproduct · 2
- HEADLACEmalware · 2
- Recorded Futurevendor · 1
- European defense organizationsvictim · 1
- European diplomatic organizationsvictim · 1
- Insikt Grouporganization · 1
- HOOKEDGEproduct · 1
- HEADLACEproduct · 1
- Symantecorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.