APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
Threat actor
Forest Blizzard
- Mentions · 7d0
- Mentions · 30d2
- All mentions4
- First seenAug 28, 2026
- Last mentioned9d ago
Timeline
4 articles · newest firstAPT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
78
Appears with
- Fancy Bearthreat actor · 4
- Recorded Futureorganization · 4
- APT28threat actor · 4
- Hookedgemalware · 4
- GRUorganization · 3
- BlueDeltathreat actor · 3
- HEADLACEmalware · 2
- Microsoft Edgeproduct · 2
- Microsoft Wordproduct · 2
- Symantecorganization · 2
- Swallowtailthreat actor · 2
- Recorded Futurevendor · 1
- HEADLACEproduct · 1
- HOOKEDGEproduct · 1
- Insikt Grouporganization · 1
- ld.exemalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.