APT28 used Hookedge to tunnel into NATO shipbuilder
The unnamed intrusion began July 24, 2026, via a Word macro and lasted at least two months.
Stories per day · 30 days
2 RSS
Relatedapt285nato5defense3espionage2ssh-tunnel2credential-theft1fancy-bear1gru1legionrelay1naval1spearphishing1ukraine1
8 stories, newest first · one card per story
Stories tagged #hookedge
APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
APT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
APT28 targeted European defense firms in two NATO countries, Symantec says
A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.
1
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
BlueDelta Targets Defense and Diplomacy with HOOKEDGE
Recorded Future reports Russian state-sponsored group BlueDelta deploying the HOOKEDGE backdoor against European defense and diplomatic organizations.