APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
Product
Microsoft Word
- Mentions · 7d0
- Mentions · 30d4
- All mentions8
- First seenAug 17, 2026
- Last mentioned9d ago
Timeline
8 articles · newest firstAPT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
Microsoft Patches Two Dozen RCE Flaws in Office
Microsoft patched about two dozen high-severity Office remote-code-execution flaws, none known exploited.
74
An open-source, clean-room reimplementation of Microsoft Word in pure Rust
Wordcraft is an open-source, clean-room Rust reimplementation of Microsoft Word.
3
Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.
80
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign
Aggah campaign abuses Bit.ly, BlogSpot, and Pastebin as multi-hop C2 to deliver RevengeRAT across the Middle East, US, Europe, and Asia.
50
New Malware 'Rover' Targets Indian Ambassador to Afghanistan
Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.
40
Related CVEs
by mentions- CVE-2010-333389%—Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution
- CVE-2026-85877<1%8.8Heap-Based Buffer Overflow RCE in Windows Print Spooler Components (CVE-2026-85877)
- CVE-2026-83997<1%8.1Use-After-Free RCE in Windows Message Queuing (MSMQ)
- CVE-2026-83986<1%7.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally
- CVE-2026-83985<1%7.8Heap Buffer Overflow in Windows Biometric Service Enables Local Privilege Escalation
- CVE-2026-83979<1%7.8Use-After-Free Privilege Escalation in Windows Biometric Service
- CVE-2026-84000<1%7.8Heap Buffer Overflow in Microsoft Graphics Component Enables Local Code Execution
- CVE-2026-83978<1%7.8Local Privilege Elevation via Heap Buffer Overflow in Windows Biometric Service
- CVE-2026-84001<1%7.5Out-of-bounds Read in Windows Kerberos KDC Enables Network Denial of Service
- CVE-2026-85360<1%7.0Use-After-Free Local Privilege Escalation in Windows Kernel (CVE-2026-85360)
Appears with
- Microsoftvendor · 5
- Microsoft Edgeproduct · 3
- Microsoft Excelproduct · 3
- APT28threat actor · 3
- Hookedgemalware · 3
- Forest Blizzardthreat actor · 2
- Swallowtailthreat actor · 2
- Microsoftorganization · 2
- HEADLACEmalware · 2
- GRUorganization · 2
- Fancy Bearthreat actor · 2
- BlueDeltathreat actor · 2
- Recorded Futureorganization · 2
- Unit 42organization · 2
- Symantecorganization · 2
- Indian Ambassador to Afghanistanvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.