BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor
BlueDelta (GRU/APT28) Targets Defense and Diplomacy with (TL-2026-2173), also tracked as HOOKEDGE Campaign, is a high-severity advanced persistent threat campaign, first published 2026-08-27 and last reviewed 2026-08-30. It is attributed to BlueDelta (Russia) with medium confidence, affects Microsoft Microsoft Word (Office VBA macros), maps to 17 MITRE ATT&CK techniques (T1005, T1027.013, T1041), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-2173
- Threat ID
- TL-2026-2173
- Also known as
- HOOKEDGE Campaign, Operation MacroMaze
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-08-27
- Last reviewed
- 2026-08-30
- Attribution
- BlueDelta
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, diplomatic
- Target regions
- romania, spain, Türkiye, Europe
- Detection rules
- 9
- Indicators of compromise
- 41
- Updates
- 2026-08-30 · revalidated 1× · latest source
Malware and tooling in BlueDelta (GRU/APT28) Targets Defense and Diplomacy with
Malware and tooling: HOOKEDGE, Headlace, SOURFACE, msedge.exe
Recorded Future's Insikt Group reports that BlueDelta, a Russian GRU (Unit 26165)-attributed group overlapping with APT28/Fancy Bear/Forest Blizzard, ran espionage campaigns from late September 2025 through at least April 2026 using a new lightweight Windows batch-script backdoor, HOOKEDGE, delivered via spearphishing against defense-manufacturing, diplomatic, and government targets in Romania, Spain, and Türkiye. HOOKEDGE abuses the legitimate webhook.site service and Microsoft Edge for C2, tasking, and exfiltration, and is assessed as the direct evolutionary successor to BlueDelta's earlier HEADLACE backdoor.
How BlueDelta (GRU/APT28) Targets Defense and Diplomacy with works
BlueDelta — the Russian GRU 85th GTsSS (Unit 26165) group tracked elsewhere as APT28, Fancy Bear, Forest Blizzard, Sofacy, Sednit, and Pawn Storm — is running an espionage campaign against defense-manufacturing, diplomatic, and government organizations in Romania, Spain, and Türkiye using a new backdoor Recorded Future's Insikt Group calls HOOKEDGE. Insikt Group attributes the activity to BlueDelta with moderate confidence based on code overlap, tradecraft consistency, and targeting alignment with Russian intelligence priorities; no CVE or CVSS applies, as the campaign relies entirely on social engineering rather than software exploitation.
HOOKEDGE is delivered via macro-enabled Microsoft Word documents. The earliest identified lure, first seen 26 September 2025, impersonates a 15 September 2025 meeting agenda from Spain's Ministry of the Presidency, Justice and Relations with the Cortes — created shortly after a genuine 8 September 2025 Spanish-Moldovan diplomatic meeting, exploiting real diplomatic activity (and likely interest in Moldova's September 2025 parliamentary elections) as a social-engineering hook. An AutoOpen() macro drops six files with GUID-style names into %USERPROFILE% (VBScript launchers, .bat/.cmd payload scripts, and HTML/XHTML exfiltration templates), then registers a self-deleting Scheduled Task to re-run the VBScript launcher every 5-30 minutes depending on campaign phase.
HOOKEDGE's core loop retrieves .cmd command payloads from a staging webhook.site endpoint, executes them via the Windows Command Shell, and exfiltrates output through a second, separate webhook.site endpoint — deliberately splitting tasking from exfiltration infrastructure. Command execution and exfiltration are proxied through msedge.exe run in headless or hidden-window mode, so C2 traffic blends into ordinary HTTPS browser activity; exfiltration specifically renders a locally-built HTML file whose auto-submitting form POSTs command output to the webhook endpoint when opened in Edge. The operators layered in "canary" tracking: hidden INCLUDEPICTURE image references named docopened.jpg/doc.jpg fire when the lure document is opened, and (from January 2026) mailopened.jpg fires on email open, giving BlueDelta delivery-funnel visibility. Because webhook.site's free tier caps requests at 100 per endpoint, the group progressively extended beaconing intervals (30 to as long as 61 minutes) and rotated in dedicated second-stage endpoints for high-value victims to conserve endpoint capacity. BlueDelta administered its webhook.site endpoints from NordVPN exit IPs to obscure operator attribution.
HOOKEDGE shares its second-stage payload's variable names, structure, and base64 encoding scheme with BlueDelta's 2023 HEADLACE backdoor (itself deployed in a three-phase, April-December 2023 campaign against Ukrainian, transportation-sector, and Azerbaijani targets) and both share the same core design pattern — batch-script backdoors abusing legitimate internet services and hidden browser instances for C2 — leading Insikt Group to assess HOOKEDGE as HEADLACE's direct evolutionary successor rather than a new tool family.
Overlapping, independently reported activity: S2 Grupo's Lab52 publicly documented closely related webhook.site-abusing macro activity as "Operation MacroMaze" (published 13 February 2026), attributing it to APT28/Fancy Bear/Forest Blizzard and observing the same %USERPROFILE% six-file drop pattern, the same INCLUDEPICTURE canary technique, and overlapping webhook.site endpoint IDs and file hashes, against government, diplomatic, and critical-infrastructure targets in Poland, Ukraine, Germany, and France between late September 2025 and January 2026 — corroborating BlueDelta/HOOKEDGE tradecraft against a wider set of European targets than Recorded Future's Romania/Spain/Türkiye reporting alone covers.
Tradecraft evolved steadily across the tracked period: October-December 2025 saw a shift from diplomatic-themed lures to generic "Enable Content" junk-data lures and a fake Microsoft Word error dialog designed to suppress victim scrutiny after execution; December 2025 moved Edge execution from headless to a hidden window; January 2026 added the email-open canary and (per Lab52) SendKeys-simulated keystrokes to bypass Office's Enable Content protection prompt; by April 2026 the group had expanded to Türkiye-targeting variants with modified canary filenames and minor VBA obfuscation changes, and by June 2026 had dropped the document-open canary from newer samples.
MITRE ATT&CK techniques used in TL-2026-2173
Collection
T1005 Data from Local System; T1074.001 Data Staged: Local Data Staging
Defense Evasion
T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer
Discovery
T1083 File and Directory Discovery
Initial Access
T1566.001 Phishing: Spearphishing Attachment
Resource Development
Affected products and versions in BlueDelta (GRU/APT28) Targets Defense and Diplomacy with
- Microsoft — Microsoft Word (Office VBA macros)
Vulnerable versions: all versions supporting VBA macro execution via AutoOpen()
Fixed in: N/A — not a software vulnerability; mitigated by blocking internet-sourced macros - Microsoft — Microsoft Edge (msedge.exe)
Vulnerable versions: abused as a living-off-the-land headless/hidden-window HTTP execution and exfiltration engine; the browser itself is not exploited
Fixed in: N/A
Remediation for BlueDelta (GRU/APT28) Targets Defense and Diplomacy with
Patches
- Not applicable — HOOKEDGE relies on social engineering and native Office/Windows scripting (VBA macros, VBScript, batch, Scheduled Tasks), not a software vulnerability; no CVE is associated with this campaign.
Immediate actions
- Block or alert on outbound traffic to webhook.site from endpoints, or restrict it to an approved allowlist — BlueDelta uses it for tasking, canary tracking, and exfiltration.
- Enforce Office macro blocking for documents originating from the internet (Mark of the Web) via Group Policy / ASR rules, since AutoOpen() macro execution is the initial-access trigger.
- Hunt for Scheduled Tasks created and then self-deleted (task XML written and removed within seconds) and for msedge.exe spawned headless or with hidden/off-screen window flags by non-interactive parent processes (wscript.exe, cmd.exe).
- Hunt %USERPROFILE% for recently created clusters of GUID-named .vbs/.bat/.cmd/.htm/.xhtml files.
Workarounds
- Disable Office macros from the internet organization-wide; restrict AutoOpen()-capable macro execution to signed, trusted templates only.
- Restrict or proxy-inspect outbound traffic to webhook.site and similar public webhook relay services at the network egress point.
Longer-term hardening
- Deploy EDR behavioral detection for living-off-the-land abuse of legitimate SaaS webhook/collaboration endpoints (Discord, Slack, webhook.site) as C2/exfil channels, per MITRE T1567.004 guidance.
- Deploy EDR coverage for browser-as-C2-proxy patterns (headless/hidden-window browser invocation initiating outbound POSTs shortly after document open).
- User awareness training for diplomatic/government/defense staff on spearphishing lures that repurpose real, recent meeting/agenda content.
Timeline of BlueDelta (GRU/APT28) Targets Defense and Diplomacy with
- BlueDelta runs a three-phase espionage campaign (April-December 2023, exact start day not specified in source) deploying the earlier HEADLACE batch-script backdoor against Ukrainian, European-transportation, and Azerbaijani targets — the tool HOOKEDGE later evolves from.
- Spain's Ministry of the Presidency, Justice and Relations with the Cortes holds a real meeting with Moldovan officials, which BlueDelta later repurposes as a spearphishing lure pretext.
- First webhook-macro dropper variant (Lab52 Variant 1) detected, using a lure impersonating a Spanish Ministry agenda dated 18 September 2025.
- Earliest identified HOOKEDGE lure document observed by Recorded Future's Insikt Group — a macro-enabled Word document impersonating the Spanish Ministry of the Presidency's 15 September 2025 meeting agenda.
- BlueDelta shifts from diplomatic-themed lures to generic 'Enable Content' junk-data lures; beaconing interval reduced from 30 to 20 minutes; Lab52 documents a variant adding a fake Microsoft Word error dialog to suppress post-execution scrutiny (exact day approximate).
- Edge-based C2/exfiltration execution changes from headless mode to a hidden window; Lab52 documents a variant that removes prior cleanup routines (exact day approximate).
- Email-open canary (mailopened.jpg) introduced alongside the existing document-open canary; Lab52 documents a variant adding SendKeys-simulated keystrokes to bypass Office's 'Enable Content' prompt and an extended ~61-minute beaconing interval (exact day approximate).
- Minor updates made to HOOKEDGE lure documents ahead of the mailopened.jpg canary rollout.
- S2 Grupo's Lab52 publishes 'Operation MacroMaze,' publicly attributing closely related webhook.site-abusing macro-dropper activity to APT28/Fancy Bear/Forest Blizzard against Poland, Ukraine, Germany, and France.
- Türkiye-targeting HOOKEDGE variants identified, with modified canary filenames and minor VBA obfuscation changes (exact day approximate).
- Document-open canary functionality removed from newer HOOKEDGE samples (exact day approximate).
- Recorded Future's Insikt Group publicly publishes the BlueDelta HOOKEDGE research report; corroborating coverage follows from Security Affairs, The Hacker News, GBHackers, CyberPress, and Industrial Cyber.
Update history for TL-2026-2173
- 2026-08-30 — Russian APT BlueDelta (APT28/Fancy Bear/Forest Blizzard) Deploys HOOKEDGE Backdoor Against European Defense and Diplomatic Targets: What changed No field escalations — severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and attribution_confidence (MEDIUM) are all unchanged. This update is pure intel enrichment: additional webhook.site endpoints, dropped-file name
Sources cited for BlueDelta (GRU/APT28) Targets Defense and Diplomacy with
- BlueDelta Targets Defense and Diplomacy with HOOKEDGE
- GRU's BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaign
- Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure
- APT28 Targeted European Entities Using Webhook-Based Macro Malware
- APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch, Group G0007
- Operation MacroMaze: APT28 Macro Phish via Webhooks
- Operation MacroMaze: APT28 exploits webhooks for covert data exfiltration
More in apt
- Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated Cyberattacks and Data Theft
- Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi (CaptiveCrunch), and Take Over WhatsApp Accounts Against Ukrainian/European Government and Drone-Supply-Chain Targets
- Iran Exploits SS7 Roaming Infrastructure and Commercial Ad-Tech to Track US Military Smartphones During Operation Epic Fury
- China-Based AI Companies Conducting Industrial-Scale Knowledge Distillation Campaigns Against U.S. Frontier AI Models
- China-Nexus and India-Nexus Espionage Groups Converge on Pakistani Law Enforcement Digitalization Platforms ("One Target, Two Flags")
Detection coverage for TL-2026-2173
As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2173 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.