57
57
57
57
57
57
57
57
60
57
60
60
57
57
57
60
57
57
60
57
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.
78
60
57
57
57
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
Bitdefender reports SilkParasite, a China-nexus espionage cluster targeting Central Asian governments with seven RATs, five newly documented, delivered via spearphished RAR archives.
Bitdefender Labs assesses with medium confidence that SilkParasite, first discovered in late 2025, is a China-nexus cluster targeting government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. Attacks use password-protected RAR archives with malicious Office documents, macro-triggered DLL sideloading, and checks for running Kaspersky AV before execution. The arsenal spans seven RAT families in .NET, C++, Go, and JavaScript with plugin architectures and diverse C2 channels including Google Drive and HTTP cookie/ETag headers; roughly 65 DriveSilkRAT infections were observed, mostly in Asia. Ties to China include BLOODALCHEMY (a Deed RAT/ShadowPad descendant) and an improved SpiceRAT used by SneakyChef, with traces of AI-assisted development in the tooling and lures.
70
60
57
57
57
57
57
57
60
60
57
57
57
57
57