# APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor

> Symantec reported a Russia-linked APT28 (Fancy Bear / BlueDelta / Forest Blizzard, GRU) campaign that compromised a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two European NATO countries. Activity used spear phishing with malicious Word documents, credential theft, network reconnaissance, the Hookedge backdoor and a previously undocumented in-memory decrypt-and-execute tool.

- **Published:** 2026-10-20T10:12:45Z
- **Last reviewed:** 2026-10-22T03:15:43.343Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3949
- **ID:** TL-2026-3949
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 55 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Symantec's reporting, relayed by The Record from Recorded Future News on 2026-10-20, describes an APT28 intrusion set that hit a naval shipbuilder, a military aircraft engine manufacturer and a law enforcement agency in two European NATO countries. The victims are not named. The first confirmed infection was on 2026-07-24, when an employee opened a malicious Word document received by email. Related activity was detected through 2026-09-24, so the campaign ran for at least two months. Symantec analyst Dick O'Brien said that given the nature of the targets, it is reasonable to assume defense-related information was the objective. Symantec's own report could not be retrieved, so details about the victims come only from the news article.

Post-compromise activity in the article consists of credential theft, network reconnaissance and information gathering using the Hookedge backdoor. The article also describes a previously undocumented tool whose function is to decrypt and execute malicious code directly in memory; its exact purpose is unclear. No IOCs or CVEs were published for this specific intrusion.

Hookedge was first documented in August 2026 by Recorded Future's Insikt Group, which disclosed it on 2026-08-28 and attributed it to BlueDelta (APT28) with moderate confidence. Insikt's campaigns ran from late September 2025 to early April 2026 against government and diplomatic organizations in Romania, Spain and Turkiye, with newer variants seen in June and July 2026. Hookedge is a lightweight Windows batch-script backdoor delivered by macro-enabled Word documents. On macro execution, AutoOpen() drops six files into %userprofile%, a scheduled task runs the launcher every 30 minutes (first stage) or as often as every 5 minutes (second stage), and the installer then deletes itself. The backdoor polls a webhook.site staging endpoint through msedge.exe (headless, later a hidden window), downloads .75e fragments that it concatenates into a .cmd file, runs the command, wraps the output in an HTML header and footer, and POSTs it to a separate exfiltration webhook via a second Edge instance. Hidden image canaries (docopened.jpg, mailopened.jpg, doc.jpg) tell operators when a document is opened. Insikt reports that Hookedge shares architecture and code with HEADLACE, which BlueDelta has used since April 2023. The IOCs below come from Insikt's Hookedge reporting and are not confirmed as the exact artifacts from the Symantec-reported victims.

## MITRE ATT&CK

- T1583.006 Web Services
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1567.004 Exfiltration Over Webhook
- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1564.003 Hide Artifacts
- T1222.001 File and Directory Permissions Modification
- T1187 Forced Authentication
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1087.001 Account Discovery
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1105 Ingress Tool Transfer
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel
- T1021.004 Remote Services
- T1102 Web Service
- T1069 Permission Groups Discovery

## Sources

- [Defense contractors in two NATO allies hacked in recent Russia-linked campaign](https://therecord.media/european-defense-contractors-fancy-bear-espionage)
- [BlueDelta Targets Defense and Diplomacy with HOOKEDGE (Recorded Future Insikt Group)](https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge)
- [APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations (The Hacker News)](https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html)
- [HOOKEDGE: APT28's Webhook-Based Espionage Backdoor (Cloud Security Alliance research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-apt28-hookedge-backdoor-20260831-csa-style/)
- [Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations (Security Affairs)](https://securityaffairs.com/197996/apt/russian-apt-bluedelta-uses-hookedge-to-target-defense-and-diplomatic-organizations.html)
- [Russian Hackers Use New HOOKEDGE Malware to Spy on European Defense and Diplomatic Targets (Cyber Security News)](https://cybersecuritynews.com/hackers-use-new-hookedge-malware/)
- [APT28 Explained: HOOKEDGE, TTPs and How to Defend in 2026 (CybelAngel)](https://cybelangel.com/blog/apt28-is-not-sophisticated/)
- [MITRE ATT&CK Group G0007: APT28](https://attack.mitre.org/groups/G0007/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3949