Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.
- HOOKEDGE is a Windows batch-script backdoor using webhook.site for both tasking and exfiltration
- Microsoft Edge (msedge.exe) used instead of common LOLBins to blend C2 traffic with normal browsing
- Two-tier operation gave high-value victims 5-minute check-ins versus 30/61-minute defaults
- Canary images mailopened.jpg and docopened.jpg tracked email opens versus macro execution
- HOOKEDGE shares code and structure with BlueDelta's earlier HEADLACE backdoor
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1059.003 Windows Command ShellT1053.005 Scheduled TaskT1071.001 Web Protocols
- Threat actors
- BlueDeltaAPT28Fancy BearForest Blizzard
- Organizations
- Recorded FutureInsikt GroupGRU
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | webhook.site | ins a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. Thi |
| url | http://webhook.site/62114596-33f5-47fb-9012-0223529e5a13/docopened.jpg | o contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting Blue |
From the original article
5 min read at securityaffairs.com
BlueDelta (APT28) uses webhook. site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments. Recorded Future’s Insikt Group documented a campaign by BlueDelta , the Russian GRU-linked group that overlaps with the group APT28 , running an entire espionage operation against European government targets using webhook.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.