# BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor

> Recorded Future's Insikt Group reports that BlueDelta, a Russian GRU (Unit 26165)-attributed group overlapping with APT28/Fancy Bear/Forest Blizzard, ran espionage campaigns from late September 2025 through at least April 2026 using a new lightweight Windows batch-script backdoor, HOOKEDGE, delivered via spearphishing against defense-manufacturing, diplomatic, and government targets in Romania, Spain, and Türkiye. HOOKEDGE abuses the legitimate webhook.site service and Microsoft Edge for C2, tasking, and exfiltration, and is assessed as the direct evolutionary successor to BlueDelta's earlier HEADLACE backdoor.

- **Published:** 2026-08-27T00:00:00Z
- **Last reviewed:** 2026-08-30T02:56:29.896Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2173
- **ID:** TL-2026-2173
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BlueDelta — the Russian GRU 85th GTsSS (Unit 26165) group tracked elsewhere as APT28, Fancy Bear, Forest Blizzard, Sofacy, Sednit, and Pawn Storm — is running an espionage campaign against defense-manufacturing, diplomatic, and government organizations in Romania, Spain, and Türkiye using a new backdoor Recorded Future's Insikt Group calls HOOKEDGE. Insikt Group attributes the activity to BlueDelta with moderate confidence based on code overlap, tradecraft consistency, and targeting alignment with Russian intelligence priorities; no CVE or CVSS applies, as the campaign relies entirely on social engineering rather than software exploitation.

HOOKEDGE is delivered via macro-enabled Microsoft Word documents. The earliest identified lure, first seen 26 September 2025, impersonates a 15 September 2025 meeting agenda from Spain's Ministry of the Presidency, Justice and Relations with the Cortes — created shortly after a genuine 8 September 2025 Spanish-Moldovan diplomatic meeting, exploiting real diplomatic activity (and likely interest in Moldova's September 2025 parliamentary elections) as a social-engineering hook. An AutoOpen() macro drops six files with GUID-style names into %USERPROFILE% (VBScript launchers, .bat/.cmd payload scripts, and HTML/XHTML exfiltration templates), then registers a self-deleting Scheduled Task to re-run the VBScript launcher every 5-30 minutes depending on campaign phase.

HOOKEDGE's core loop retrieves .cmd command payloads from a staging webhook.site endpoint, executes them via the Windows Command Shell, and exfiltrates output through a second, separate webhook.site endpoint — deliberately splitting tasking from exfiltration infrastructure. Command execution and exfiltration are proxied through msedge.exe run in headless or hidden-window mode, so C2 traffic blends into ordinary HTTPS browser activity; exfiltration specifically renders a locally-built HTML file whose auto-submitting form POSTs command output to the webhook endpoint when opened in Edge. The operators layered in "canary" tracking: hidden INCLUDEPICTURE image references named docopened.jpg/doc.jpg fire when the lure document is opened, and (from January 2026) mailopened.jpg fires on email open, giving BlueDelta delivery-funnel visibility. Because webhook.site's free tier caps requests at 100 per endpoint, the group progressively extended beaconing intervals (30 to as long as 61 minutes) and rotated in dedicated second-stage endpoints for high-value victims to conserve endpoint capacity. BlueDelta administered its webhook.site endpoints from NordVPN exit IPs to obscure operator attribution.

HOOKEDGE shares its second-stage payload's variable names, structure, and base64 encoding scheme with BlueDelta's 2023 HEADLACE backdoor (itself deployed in a three-phase, April-December 2023 campaign against Ukrainian, transportation-sector, and Azerbaijani targets) and both share the same core design pattern — batch-script backdoors abusing legitimate internet services and hidden browser instances for C2 — leading Insikt Group to assess HOOKEDGE as HEADLACE's direct evolutionary successor rather than a new tool family.

Overlapping, independently reported activity: S2 Grupo's Lab52 publicly documented closely related webhook.site-abusing macro activity as "Operation MacroMaze" (published 13 February 2026), attributing it to APT28/Fancy Bear/Forest Blizzard and observing the same %USERPROFILE% six-file drop pattern, the same INCLUDEPICTURE canary technique, and overlapping webhook.site endpoint IDs and file hashes, against government, diplomatic, and critical-infrastructure targets in Poland, Ukraine, Germany, and France between late September 2025 and January 2026 — corroborating BlueDelta/HOOKEDGE tradecraft against a wider set of European targets than Recorded Future's Romania/Spain/Türkiye reporting alone covers.

Tradecraft evolved steadily across the tracked period: October-December 2025 saw a shift from diplomatic-themed lures to generic "Enable Content" junk-data lures and a fake Microsoft Word error dialog designed to suppress victim scrutiny after execution; December 2025 moved Edge execution from headless to a hidden window; January 2026 added the email-open canary and (per Lab52) SendKeys-simulated keystrokes to bypass Office's Enable Content protection prompt; by April 2026 the group had expanded to Türkiye-targeting variants with modified canary filenames and minor VBA obfuscation changes, and by June 2026 had dropped the document-open canary from newer samples.

## MITRE ATT&CK

- T1583.006 Acquire Infrastructure: Web Services
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1070.004 Indicator Removal: File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1074.001 Data Staged: Local Data Staging
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook
- T1497.003 Virtualization/Sandbox Evasion: Time Based Evasion
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [BlueDelta Targets Defense and Diplomacy with HOOKEDGE](https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge)
- [GRU's BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaign](https://www.recordedfuture.com/research/grus-bluedelta-targets-key-networks-in-europe-with-multi-phase-espionage-camp)
- [Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure](https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/)
- [APT28 Targeted European Entities Using Webhook-Based Macro Malware](https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html)
- [APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch, Group G0007](https://attack.mitre.org/groups/G0007/)
- [Operation MacroMaze: APT28 Macro Phish via Webhooks](https://socprime.com/active-threats/operation-macromaze/)
- [Operation MacroMaze: APT28 exploits webhooks for covert data exfiltration](https://securityaffairs.com/188421/apt/operation-macromaze-apt28-exploits-webhooks-for-covert-data-exfiltration.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2173