Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
58
Malware
Hookedge
- Mentions · 7d0
- Mentions · 30d6
- All mentions9
- First seenAug 27, 2026
- Last mentioned7d ago
Timeline
9 articles · newest firstAPT28 used Hookedge to tunnel into NATO shipbuilder
The unnamed intrusion began July 24, 2026, via a Word macro and lasted at least two months.
76
APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
APT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
APT28 targeted European defense firms in two NATO countries, Symantec says
A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.
76
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
78
BlueDelta Targets Defense and Diplomacy with HOOKEDGE
Recorded Future reports Russian state-sponsored group BlueDelta deploying the HOOKEDGE backdoor against European defense and diplomatic organizations.
72
Appears with
- APT28threat actor · 8
- Recorded Futureorganization · 6
- Symantecorganization · 6
- Fancy Bearthreat actor · 4
- GRUorganization · 4
- BlueDeltathreat actor · 4
- Forest Blizzardthreat actor · 4
- Microsoft Wordproduct · 3
- Microsoft Edgeproduct · 3
- Swallowtailthreat actor · 3
- HEADLACEmalware · 3
- HOOKEDGEproduct · 1
- OpenSSHproduct · 1
- Eburymalware · 1
- Insikt Grouporganization · 1
- Google Threat Intelligence Grouporganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.