APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
Threat actor
Fancy Bear
- Mentions · 7d0
- Mentions · 30d2
- All mentions6
- First seenAug 18, 2026
- Last mentioned11d ago
Timeline
6 articles · newest firstAPT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators
Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.
62
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
78
Fancy Bear Exploits Office Flaw
Fancy Bear (APT28) is reported exploiting a Microsoft Office flaw, per Infosecurity Magazine; details unavailable.
55
Appears with
- APT28threat actor · 6
- Recorded Futureorganization · 4
- Forest Blizzardthreat actor · 4
- GRUorganization · 4
- Hookedgemalware · 4
- BlueDeltathreat actor · 3
- Microsoft Edgeproduct · 2
- HEADLACEmalware · 2
- Symantecorganization · 2
- Swallowtailthreat actor · 2
- Microsoft Wordproduct · 2
- The Guardianorganization · 1
- OpenSSHproduct · 1
- Military Unit 26165organization · 1
- Microsoft Officeproduct · 1
- APT44threat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.