Threat reportAPTTL-2026-3949
APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor
APT28 (Fancy Bear) Espionage Campaign Against European (TL-2026-3949), also tracked as Hookedge campaign, is a high-severity advanced persistent threat campaign, first published 2026-10-20 and last reviewed 2026-10-22. It is attributed to APT28 (Russia) with high confidence, affects Microsoft Windows, maps to 28 MITRE ATT&CK techniques (T1016, T1021.004, T1027), and is covered by 9 detection rules and 55 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 28MITRE ATT&CK
- Actors
- 1APT28
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 55Indicators of compromise
Key facts for TL-2026-3949
- Threat ID
- TL-2026-3949
- Also known as
- Hookedge campaign, BlueDelta HOOKEDGE
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- defense, shipbuilding, aerospace, police - law enforcement, government administration, diplomatic
- Target regions
- Europe, NATO member states
- Detection rules
- 9
- Indicators of compromise
- 55
- Updates
- 2026-10-22 · 2 updates · revalidated 2× · latest source
Malware and tooling in APT28 (Fancy Bear) Espionage Campaign Against European
Malware and tooling: HOOKEDGE, Headlace, SOURFACE
How APT28 (Fancy Bear) Espionage Campaign Against European works
Symantec reported a Russia-linked APT28 (Fancy Bear / BlueDelta / Forest Blizzard, GRU) campaign that compromised a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two European NATO countries. Activity used spear phishing with malicious Word documents, credential theft, network reconnaissance, the Hookedge backdoor and a previously undocumented in-memory decrypt-and-execute tool.
Symantec's reporting, relayed by The Record from Recorded Future News on 2026-10-20, describes an APT28 intrusion set that hit a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two European NATO countries. The victims are not named. The first confirmed infection was on 2026-07-24, when an employee opened a malicious Word document received by email. Related activity was detected through 2026-09-24, so the campaign ran for at least two months. Symantec analyst Dick O'Brien said that given the nature of the targets, it is reasonable to assume defense-related information was the objective. Symantec's own report could not be retrieved, so details about the victims come only from the news article.
Post-compromise activity in the article consists of credential theft, network reconnaissance and information gathering using the Hookedge backdoor. The article also describes a previously undocumented tool whose function is to decrypt and execute malicious code directly in memory; its exact purpose is unclear. No IOCs or CVEs were published for this specific intrusion.
Hookedge was first documented in August 2026 by Recorded Future's Insikt Group, which disclosed it on 2026-08-28 and attributed it to BlueDelta (APT28) with moderate confidence. Insikt's campaigns ran from late September 2025 to early April 2026 against government and diplomatic organizations in Romania, Spain and Turkiye, with newer variants seen in June and July 2026. Hookedge is a lightweight Windows batch-script backdoor delivered by macro-enabled Word documents. On macro execution, AutoOpen() drops six files into %userprofile%, a scheduled task runs the launcher every 30 minutes (first stage) or as often as every 5 minutes (second stage), and the installer then deletes itself. The backdoor polls a webhook.site staging endpoint through msedge.exe (headless, later a hidden window), downloads .75e fragments that it concatenates into a .cmd file, runs the command, wraps the output in an HTML header and footer, and POSTs it to a separate exfiltration webhook via a second Edge instance. Hidden image canaries (docopened.jpg, mailopened.jpg, doc.jpg) tell operators when a document is opened. Insikt reports that Hookedge shares architecture and code with HEADLACE, which BlueDelta has used since April 2023. The IOCs below come from Insikt's Hookedge reporting and are not confirmed as the exact artifacts from the Symantec-reported victims.
MITRE ATT&CK techniques used in TL-2026-3949
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087.001 Account Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1222.001 File and Directory Permissions Modification; T1564.003 Hide Artifacts; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.004 Exfiltration Over Webhook
Persistence
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
Collection
Credential Access
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in APT28 (Fancy Bear) Espionage Campaign Against European
Remediation for APT28 (Fancy Bear) Espionage Campaign Against European
Immediate actions
- Hunt for scheduled tasks launching GUID-named .vbs/.cmd/.bat files from %userprofile%
- Alert on msedge.exe launched with --headless=new or as a hidden/1x1 window by wscript.exe, cmd.exe or a scheduled task
- Block or alert on outbound connections to webhook.site and similar request-inspection services unless explicitly authorized
- Reset credentials and review authentication logs for any host where the lure document or Hookedge artifacts are found
Workarounds
- Block VBA macro execution in Office documents originating from the internet
- Restrict email attachment types and detonate macro-enabled Office documents in a sandbox
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2 or certificate-based) for external services
- Run incident response procedures for phishing investigation, credential compromise identification and rapid host containment
- Monitor for in-memory decrypt-and-execute behavior with EDR
Timeline of APT28 (Fancy Bear) Espionage Campaign Against European
- BlueDelta begins using the HEADLACE modular backdoor against diplomats; Hookedge later shares its architecture and code (April 2023, day approximate).
- Earliest Hookedge lure document, impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, is created.
- Hookedge switches from headless Edge to a hidden Edge window for C2 requests.
- Email-open canary (mailopened.jpg) added to lure documents.
- Hookedge VBA obfuscation refined and canary removed in a newer variant.
- First confirmed infection in the Symantec-reported campaign: an employee at a targeted defense organization opens a malicious Word document.
- C2 moves from webhook.site to dedicated server 185.82.218.119; SSH private key pulled via curl and a reverse SSH tunnel opened to the internal network; interactive reconnaissance begins.
- SSH tunnel terminated with taskkill /f /t /im ssh.exe; NTLM handshake capture via a loopback listener and hands-on commands continue through 2026-07-29.
- Previously undocumented reflective loader ld.exe run against C:\ProgramData\Events.dat; payload not recovered.
- Recorded Future Insikt Group publicly documents Hookedge and attributes it to BlueDelta (APT28) with moderate confidence.
- Most recent related activity detected by Symantec against the naval shipbuilder, aircraft engine manufacturer and law enforcement victims.
- The Record reports Symantec's findings on APT28 intrusions at defense contractors in two NATO countries.
- Symantec Threat Hunter Team publishes its Swallowtail report on APT28 intrusions at a shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two NATO states.
Update history for TL-2026-3949
- 2026-10-22 — APT28 (Fancy Bear / Swallowtail) Opens Reverse SSH Tunnel into NATO Naval Shipbuilder Network Using HOOKEDGE Backdoor and ld.exe Reflective Loader: What changed Exploitability NONE → ACTIVE. Symantec's primary report confirms hands-on intrusion activity from 2026-07-24 to 2026-09-24. Severity is unchanged at HIGH. New indicators (6) 4 new HOOKEDGE dropper SHA-256 hashes, the full rever
- 2026-10-20 — Swallowtail (APT28 / Fancy Bear / Forest Blizzard) Espionage Campaign Against NATO Shipbuilder, Aircraft Engine Maker and Law Enforcement Agency (Hookedge Backdoor, ld.exe Loader): What changed Attribution confidence MEDIUM → HIGH: Symantec's primary report directly attributes the intrusions to Swallowtail (APT28). Severity, exploitability and status are unchanged. New indicators (22) Dedicated C2 185.82.218.119, 5 ne
Sources cited for APT28 (Fancy Bear) Espionage Campaign Against European
- Defense contractors in two NATO allies hacked in recent Russia-linked campaign
- BlueDelta Targets Defense and Diplomacy with HOOKEDGE (Recorded Future Insikt Group)
- APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations (The Hacker News)
- HOOKEDGE: APT28's Webhook-Based Espionage Backdoor (Cloud Security Alliance research note)
- Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations (Security Affairs)
- Russian Hackers Use New HOOKEDGE Malware to Spy on European Defense and Diplomatic Targets (Cyber Security News)
- APT28 Explained: HOOKEDGE, TTPs and How to Defend in 2026 (CybelAngel)
- MITRE ATT&CK Group G0007: APT28
Detection coverage for TL-2026-3949
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3949 across Splunk SPL, Microsoft KQL and Sigma, covering 55 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.