APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
Malware
HEADLACE
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenAug 28, 2026
- Last mentioned10d ago
Timeline
3 articles · newest firstRussian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
78
Appears with
- HOOKEDGEmalware · 3
- APT28threat actor · 3
- Fancy Bearthreat actor · 2
- Microsoft Wordproduct · 2
- BlueDeltathreat actor · 2
- Recorded Futureorganization · 2
- Microsoft Edgeproduct · 2
- Forest Blizzardthreat actor · 2
- UAC-0244threat actor · 1
- CAMELSPYmalware · 1
- DarkSwordmalware · 1
- GRUorganization · 1
- UNC6353threat actor · 1
- Corunamalware · 1
- Swallowtailthreat actor · 1
- webhook.siteproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.