Search: “BlueDelta”

31 stories

Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.

Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.

Security AffairsAug 28, 11:26 UTC · 19d agoThreat actor in the wild1

APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).

Recorded Future's Insikt Group identified campaigns deploying the previously undocumented HOOKEDGE backdoor against government and diplomatic organizations in Romania, Spain and Türkiye from late September 2025 to early April 2026. The lightweight Windows batch backdoor is delivered via macro-enabled Word documents and attributed with moderate confidence to APT28 (Fancy Bear, tracked as BlueDelta), described as the evolutionary successor to HEADLACE, using webhook.site for C2, payload staging and exfiltration. HOOKEDGE fetches .cmd payloads and returns output through headless Microsoft Edge HTTP requests, maintains a 30-minute scheduled task, and a second-stage implant gives high-value targets five-minute beaconing for interactive operator tasking.

The Hacker NewsAug 28, 08:20 UTC · 19d agoThreat actor in the wild

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Recorded Future reports Russian state-sponsored group BlueDelta deploying the HOOKEDGE backdoor against European defense and diplomatic organizations.

Recorded Future research reports that BlueDelta, a Russian state-sponsored threat group, is using the HOOKEDGE backdoor in campaigns targeting defense and diplomatic organizations across Europe. The disclosure details the group's use of the backdoor in espionage-focused operations against high-value government and military targets.

Recorded FutureAug 27, 00:00 UTC · 20d agoThreat actor in the wild

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting

The Hacker NewsMay 31, 10:10 UTC · May 31, 2024Malware

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business NewsAug 28, 04:40 UTC · 19d agoPolicy & legal in the wild1

Search: “BlueDelta”

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting

Risky Bulletin: Two TeamPCP members arrested in Australia

Russia-linked APT TAG-110 uses targets Europe and Asia

Russian Cyber Spies Target Organizations with Custom Malware

Russian military hackers revive advanced malware to spy on Ukraine, researchers say

2026 FIFA World Cup: What Public Safety Officials Need to Know

APT28 conducts long-term espionage on Ukrainian forces using custom malware

APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military

Russian hackers deploy new malware in phishing campaign targeting Ukraine

ClickFix Campaigns Targeting Windows and macOS

Russian state hackers exploit new Microsoft Office flaw in attacks on Ukraine, EU

Suspected Russian hacker reportedly detained in Thailand, faces possible US extradition

2024 Malicious Infrastructure Insights: Key Trends and Threats

Microsoft and CrowdStrike Launch Shared Threat Actor Glossary to Cut Attribution Confusion

Russia-linked APT28 targets western logistics entities and technology firms

Western intelligence agencies unite to expose Russian hacking campaign against logistics and tech firms

Kazakhstan to audit foreign ministry after suspected Russia

Russia-Linked Hackers Target Kazakhstan in Espionage Campaign with HATVIBE Malware

Hackers with likely Kremlin ties target Kazakhstan in espionage campaign

Dozens of Central Asian targets hit in recent Russia-linked cyber

Is Russian group APT28 behind the cyber attack on the German air traffic control agency (DFS)?

APT28 Targets Diplomats with HeadLace Malware via Car Sale Phishing Lure

Ukrainian Institutions Targeted Using HATVIBE and CHERRYSPY Malware

Possible APT28-linked hackers target Ukraine’s scientific institutions

Russia-linked APT28 used tool GooseEgg for to exploit Win bug

Russia-linked APT TAG-70 targets European government and military mail servers exploiting Roundcube XSS

DOJ’s Monaco: US focus on rolling up ransomware and cybercriminals will continue apace

Russian APT28 Hackers Targeting High