Skip to navigation

Threat reportAPTTL-2026-2173

BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor

highACTIVE

Recorded Future's Insikt Group reports that BlueDelta, a Russian GRU (Unit 26165)-attributed group overlapping with APT28/Fancy Bear/Forest Blizzard, ran espionage campaigns from late September 2025 through at least April 2026 using a new lightweight Windows batch-script backdoor, HOOKEDGE, delivered via spearphishing against defense-manufacturing, diplomatic, and government targets in Romania, Spain, and Türkiye.

Key facts for APT28 HOOKEDGE defense diplomacy lures

IdentifiersTL-2026-2173
Also known asHOOKEDGE Campaign, Operation MacroMaze
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsMicrosoft Microsoft Word (Office VBA macros); Microsoft Microsoft Edge (msedge.exe)
AttributionAPT28 (medium confidence)
Nation-state nexusRussia
MalwareHOOKEDGE, Headlace
ToolsSOURFACE, msedge.exe
MITRE ATT&CK techniquesT1005 Data from Local System, T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, T1041 Exfiltration Over C2 Channel, T1053.005 Scheduled Task/Job: Scheduled Task, T1059.003 Command and Scripting Interpreter: Windows Command Shell, T1059.005 Command and Scripting Interpreter: Visual Basic, T1070.004 Indicator Removal: File Deletion, T1071.001 Application Layer Protocol: Web Protocols, T1074.001 Data Staged: Local Data Staging, T1083 File and Directory Discovery, T1105 Ingress Tool Transfer, T1140 Deobfuscate/Decode Files or Information and 5 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, defense, diplomatic
Target regionsromania, spain, Türkiye, Europe
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage for APT28 HOOKEDGE defense diplomacy lures

As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2173 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: HOOKEDGE Exploitation — Word AutoOpen Macro Spawning Script Interpreter + GUID File Drop (SPL)

Detects the HOOKEDGE/BlueDelta initial-access chain: a macro-enabled Word document's AutoOpen() macro launches wscript.exe, cscript.exe, or cmd.exe, correlated with a cluster of GUID-style-named .vbs/.bat/.cmd/.htm/.xhtml files dropped into %USERPROFILE% within the same host/time window — the six-file drop pattern reported by both Recorded Future and Lab52 Operation MacroMaze.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.001, T1204.002, T1059.005
  • Data sources: sysmon, microsoft-windows-sysmon/operational
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon EventCode=1 ParentImage="*\\WINWORD.EXE"
  (Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\cmd.exe")
| eval detection_reason="Word spawned a script/command interpreter (macro AutoOpen chain)"
| join type=left host
    [ search index=sysmon EventCode=11 TargetFilename="*\\Users\\*"
      | regex TargetFilename="(?i)[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.(vbs|bat|cmd|htm|xhtml)$"
      | stats count as guid_file_count values(TargetFilename) as guid_named_files by host ]
| where guid_file_count>=3
| table _time, host, User, ParentImage, Image, CommandLine, guid_named_files, guid_file_count
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in~ ("wscript.exe","cscript.exe","cmd.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has @"\Users\"
    | where FileName matches regex @"(?i)^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.(vbs|bat|cmd|htm|xhtml)$"
    | summarize GuidFileCount=count(), GuidFiles=make_set(FileName) by DeviceName
) on DeviceName
| where GuidFileCount >= 3
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, GuidFiles, GuidFileCount

Sigma

title: Suspicious Word-Spawned Script Interpreter Chain (HOOKEDGE/BlueDelta AutoOpen Macro)
id: a1b2c3d4-e5f6-4a1b-9c2d-3e4f5a6b7c8d
status: experimental
description: Detects Microsoft Word (WINWORD.EXE) spawning wscript.exe, cscript.exe, or cmd.exe consistent with HOOKEDGE/HEADLACE AutoOpen() macro execution chains used by BlueDelta (APT28).
references:
  - https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge
  - https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-27
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.005
  - attack.group.apt28
  - attack.actor.bluedelta
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\WINWORD.EXE'
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - Legitimate document-automation macros or mail-merge tooling that intentionally invoke scripting hosts from Word
level: high

Known false positives:

  • Legitimate document-automation macros, mail-merge add-ins, or enterprise macro-based workflows that intentionally invoke scripting hosts from Word
  • Security-awareness phishing simulations that deliberately trigger a scripting host from a Word macro

Tuning notes: Baseline known internal macro-automation tooling by file hash/publisher and exclude signed, allow-listed VBA projects; raise fidelity by requiring the child-process command line to reference a %USERPROFILE% path containing a GUID-style filename, matching the HOOKEDGE six-file drop pattern.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • HOOKEDGE Exploitation — Word AutoOpen Macro Spawning Script Interpreter + GUID File Drop (KQL) · unlock with TL Creds
  • HOOKEDGE Persistence — Self-Deleting Scheduled Task Re-Launching GUID VBScript (KQL) · unlock with TL Creds
  • HOOKEDGE C2/Exfiltration — Headless/Hidden-Window Edge Beaconing to [indicator] (KQL) · unlock with TL Creds
  • HOOKEDGE Exploitation — Word AutoOpen Macro Spawning Script Interpreter + GUID File Drop (Sigma) · unlock with TL Creds
  • HOOKEDGE Persistence — Self-Deleting Scheduled Task Re-Launching GUID VBScript (Sigma) · unlock with TL Creds
  • HOOKEDGE C2/Exfiltration — Headless/Hidden-Window Edge Beaconing to [indicator] (Sigma) · unlock with TL Creds
  • HOOKEDGE Persistence — Self-Deleting Scheduled Task Re-Launching GUID VBScript (SPL) · unlock with TL Creds
  • HOOKEDGE C2/Exfiltration — Headless/Hidden-Window Edge Beaconing to [indicator] (SPL) · unlock with TL Creds

Indicators of compromise for APT28 HOOKEDGE defense diplomacy lures

As of 2026-08-30, Threadlinqs Intelligence tracks 41 indicators of compromise for TL-2026-2173.

Sample indicators (3 of 41)

  • File hash: df60fa6008b1a0b79c394b42d3ada6bab18b798f3c2ca1530a3e0cb4fbbbe9f6
  • File hash: ed8f20bbab18b39a67e4db9a03090e5af8dc8ec24fe1ddf3521b3f340a8318c1
  • File hash: c3b617e0c6b8f01cf628a2b3db40e8d06ef20a3c71365ccc1799787119246010

Defanged, TLP:CLEAR. Full set of 41 indicators: unlock with TL Creds.

41 indicators of compromise · unlock with TL Creds. Compare plans

How APT28 HOOKEDGE defense diplomacy lures works

HOOKEDGE abuses the legitimate webhook.site service and Microsoft Edge for C2, tasking, and exfiltration, and is assessed as the direct evolutionary successor to BlueDelta's earlier HEADLACE backdoor.

BlueDelta — the Russian GRU 85th GTsSS (Unit 26165) group tracked elsewhere as APT28, Fancy Bear, Forest Blizzard, Sofacy, Sednit, and Pawn Storm — is running an espionage campaign against defense-manufacturing, diplomatic, and government organizations in Romania, Spain, and Türkiye using a new backdoor Recorded Future's Insikt Group calls HOOKEDGE. Insikt Group attributes the activity to BlueDelta with moderate confidence based on code overlap, tradecraft consistency, and targeting alignment with Russian intelligence priorities; no CVE or CVSS applies, as the campaign relies entirely on social engineering rather than software exploitation.

HOOKEDGE is delivered via macro-enabled Microsoft Word documents. The earliest identified lure, first seen 26 September 2025, impersonates a 15 September 2025 meeting agenda from Spain's Ministry of the Presidency, Justice and Relations with the Cortes — created shortly after a genuine 8 September 2025 Spanish-Moldovan diplomatic meeting, exploiting real diplomatic activity (and likely interest in Moldova's September 2025 parliamentary elections) as a social-engineering hook. An AutoOpen() macro drops six files with GUID-style names into %USERPROFILE% (VBScript launchers, .bat/.cmd payload scripts, and HTML/XHTML exfiltration templates), then registers a self-deleting Scheduled Task to re-run the VBScript launcher every 5-30 minutes depending on campaign phase.

HOOKEDGE's core loop retrieves .cmd command payloads from a staging webhook.site endpoint, executes them via the Windows Command Shell, and exfiltrates output through a second, separate webhook.site endpoint — deliberately splitting tasking from exfiltration infrastructure. Command execution and exfiltration are proxied through msedge.exe run in headless or hidden-window mode, so C2 traffic blends into ordinary HTTPS browser activity; exfiltration specifically renders a locally-built HTML file whose auto-submitting form POSTs command output to the webhook endpoint when opened in Edge. The operators layered in "canary" tracking: hidden INCLUDEPICTURE image references named docopened.jpg/doc.jpg fire when the lure document is opened, and (from January 2026) mailopened.jpg fires on email open, giving BlueDelta delivery-funnel visibility. Because webhook.site's free tier caps requests at 100 per endpoint, the group progressively extended beaconing intervals (30 to as long as 61 minutes) and rotated in dedicated second-stage endpoints for high-value victims to conserve endpoint capacity. BlueDelta administered its webhook.site endpoints from NordVPN exit IPs to obscure operator attribution.

HOOKEDGE shares its second-stage payload's variable names, structure, and base64 encoding scheme with BlueDelta's 2023 HEADLACE backdoor (itself deployed in a three-phase, April-December 2023 campaign against Ukrainian, transportation-sector, and Azerbaijani targets) and both share the same core design pattern — batch-script backdoors abusing legitimate internet services and hidden browser instances for C2 — leading Insikt Group to assess HOOKEDGE as HEADLACE's direct evolutionary successor rather than a new tool family.

Overlapping, independently reported activity: S2 Grupo's Lab52 publicly documented closely related webhook.site-abusing macro activity as "Operation MacroMaze" (published 13 February 2026), attributing it to APT28/Fancy Bear/Forest Blizzard and observing the same %USERPROFILE% six-file drop pattern, the same INCLUDEPICTURE canary technique, and overlapping webhook.site endpoint IDs and file hashes, against government, diplomatic, and critical-infrastructure targets in Poland, Ukraine, Germany, and France between late September 2025 and January 2026 — corroborating BlueDelta/HOOKEDGE tradecraft against a wider set of European targets than Recorded Future's Romania/Spain/Türkiye reporting alone covers.

Tradecraft evolved steadily across the tracked period: October-December 2025 saw a shift from diplomatic-themed lures to generic "Enable Content" junk-data lures and a fake Microsoft Word error dialog designed to suppress victim scrutiny after execution; December 2025 moved Edge execution from headless to a hidden window; January 2026 added the email-open canary and (per Lab52) SendKeys-simulated keystrokes to bypass Office's Enable Content protection prompt; by April 2026 the group had expanded to Türkiye-targeting variants with modified canary filenames and minor VBA obfuscation changes, and by June 2026 had dropped the document-open canary from newer samples.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074.001 Data Staged: Local Data Staging

Defense Evasion

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery

Initial Access

T1566.001 Phishing: Spearphishing Attachment

Resource Development

T1583.006 Acquire Infrastructure: Web Services

Remediation for APT28 HOOKEDGE defense diplomacy lures

Patches

  • Not applicable — HOOKEDGE relies on social engineering and native Office/Windows scripting (VBA macros, VBScript, batch, Scheduled Tasks), not a software vulnerability; no CVE is associated with this campaign.

Immediate actions

  • Block or alert on outbound traffic to webhook.site from endpoints, or restrict it to an approved allowlist — BlueDelta uses it for tasking, canary tracking, and exfiltration.
  • Enforce Office macro blocking for documents originating from the internet (Mark of the Web) via Group Policy / ASR rules, since AutoOpen() macro execution is the initial-access trigger.
  • Hunt for Scheduled Tasks created and then self-deleted (task XML written and removed within seconds) and for msedge.exe spawned headless or with hidden/off-screen window flags by non-interactive parent processes (wscript.exe, cmd.exe).
  • Hunt %USERPROFILE% for recently created clusters of GUID-named .vbs/.bat/.cmd/.htm/.xhtml files.

Workarounds

  • Disable Office macros from the internet organization-wide; restrict AutoOpen()-capable macro execution to signed, trusted templates only.
  • Restrict or proxy-inspect outbound traffic to webhook.site and similar public webhook relay services at the network egress point.

Longer-term hardening

  • Deploy EDR behavioral detection for living-off-the-land abuse of legitimate SaaS webhook/collaboration endpoints (Discord, Slack, webhook.site) as C2/exfil channels, per MITRE T1567.004 guidance.
  • Deploy EDR coverage for browser-as-C2-proxy patterns (headless/hidden-window browser invocation initiating outbound POSTs shortly after document open).
  • User awareness training for diplomatic/government/defense staff on spearphishing lures that repurpose real, recent meeting/agenda content.

Affected and fixed versions

  • Microsoft — Microsoft Word (Office VBA macros)
    Vulnerable versions: all versions supporting VBA macro execution via AutoOpen()
    Fixed in: N/A — not a software vulnerability; mitigated by blocking internet-sourced macros
  • Microsoft — Microsoft Edge (msedge.exe)
    Vulnerable versions: abused as a living-off-the-land headless/hidden-window HTTP execution and exfiltration engine; the browser itself is not exploited
    Fixed in: N/A

Timeline of APT28 HOOKEDGE defense diplomacy lures

Last updated · revalidated 1× · latest source

  • BlueDelta runs a three-phase espionage campaign (April-December 2023, exact start day not specified in source) deploying the earlier locked-ioc-39 batch-script backdoor against Ukrainian, European-transportation, and Azerbaijani targets — the tool locked-ioc-38 later evolves from.
  • Spain's Ministry of the Presidency, Justice and Relations with the Cortes holds a real meeting with Moldovan officials, which BlueDelta later repurposes as a spearphishing lure pretext.
  • First webhook-macro dropper variant (Lab52 Variant 1) detected, using a lure impersonating a Spanish Ministry agenda dated 18 September 2025.
  • Earliest identified locked-ioc-38 lure document observed by Recorded Future's Insikt Group — a macro-enabled Word document impersonating the Spanish Ministry of the Presidency's 15 September 2025 meeting agenda.
  • BlueDelta shifts from diplomatic-themed lures to generic 'Enable Content' junk-data lures; beaconing interval reduced from 30 to 20 minutes; Lab52 documents a variant adding a fake Microsoft Word error dialog to suppress post-execution scrutiny (exact day approximate).
  • Edge-based C2/exfiltration execution changes from headless mode to a hidden window; Lab52 documents a variant that removes prior cleanup routines (exact day approximate).
  • Email-open canary (locked-ioc-34) introduced alongside the existing document-open canary; Lab52 documents a variant adding SendKeys-simulated keystrokes to bypass Office's 'Enable Content' prompt and an extended ~61-minute beaconing interval (exact day approximate).
  • Minor updates made to locked-ioc-38 lure documents ahead of the locked-ioc-34 canary rollout.
  • S2 Grupo's Lab52 publishes 'Operation MacroMaze,' publicly attributing closely related locked-ioc-36-abusing macro-dropper activity to APT28/Fancy Bear/Forest Blizzard against Poland, Ukraine, Germany, and France.
  • Türkiye-targeting locked-ioc-38 variants identified, with modified canary filenames and minor VBA obfuscation changes (exact day approximate).
  • Document-open canary functionality removed from newer locked-ioc-38 samples (exact day approximate).
  • Recorded Future's Insikt Group publicly publishes the BlueDelta locked-ioc-38 research report; corroborating coverage follows from Security Affairs, The Hacker News, GBHackers, CyberPress, and Industrial Cyber.

Update history

Sources cited for APT28 HOOKEDGE defense diplomacy lures

More from APT28

Previous and next in apt

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats