Back Securityaffairs.Co

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

Securityaffairs.Co •Pierluigi Paganini • August 28, 2026

BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments. Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BlueDelta Espionage Campaign Using HOOKEDGE Targets European Governments BlueDelta, a Russian state-linked threat actor, has conducted a series of espionage campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye from late September 2025 to early April 2026. The campaigns utilized a lightweight Windows backdoor named HOOKEDGE, delivered through macro-enabled Microsoft Word documents that impersonated legitimate diplomatic communications. The backdoor exploits legitimate webhook services for command-and-control operations, allowing it to blend in with normal network traffic. The attacks are characterized by continuous refinement of the HOOKEDGE implant to evade detection and adapt to changes in defensive measures. BlueDelta has a history of targeting defense and policy-related organizations, reinforcing its focus on intelligence collection against European entities. Organizations are advised to block macro execution from internet-originated documents and enhance detection capabilities for specific behaviors associated with the malware. The current status indicates ongoing activity from BlueDelta with no signs of cessation. 5 sources 73

Extracted Entities

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

The full story

Extracted Entities

APT Groups (2)

Industries (1)

Malware (1)

Platforms (1)

Tools (1)