Full Report
Discover how the Russian state-sponsored threat group BlueDelta is using the HOOKEDGE backdoor to target defense and diplomatic organizations across Europe
Analysis Summary
# Threat Actor: BlueDelta
## Attribution & Identity
* **Actor Identification:** BlueDelta is a Russian state-sponsored threat group.
* **Affiliation:** Attributed with moderate confidence to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).
* **Known Aliases:** APT28, Fancy Bear, Forest Blizzard.
* **Associated Groups:** Overlaps with activity tracked as "Operation MacroMaz" by Lab52.
## Activity Summary
Between late September 2025 and early April 2026, BlueDelta conducted initial access campaigns targeting European government and diplomatic entities. The group utilized macro-enabled Microsoft Word documents to deploy a lightweight Windows batch-script backdoor named **HOOKEDGE**. These campaigns were characterized by the use of diplomatic lures, including impersonation of the Spanish Ministry of the Presidency, likely to gather intelligence ahead of regional political events such as Moldova’s 2025 elections.
## Tactics, Techniques & Procedures
* **Initial Access:** Spearphishing using macro-enabled Word documents (diplomatic and generic lures).
* **Execution:** Use of Windows Command Shell and Visual Basic scripts; abuse of headless Microsoft Edge execution.
* **Persistence:** Establishing Scheduled Tasks for persistence and periodic beaconing.
* **Living-off-the-Land (LotL):** Heavy reliance on Windows batch scripts and legitimate internet services (LIS).
* **Command and Control (C2):** Abuse of legitimate webhook services (specifically *webhook[.]site*) for C2, payload staging, and data exfiltration to blend with legitimate traffic.
* **Defense Evasion:** Use of encryption/encoding, file deletion, and evolving beaconing intervals to bypass automated sandboxes and API limits.
**MITRE ATT&CK IDs:**
* **Resource Development:** T1583.006 (Web Services)
* **Execution:** T1059.003 (Windows Command Shell), T1059.005 (Visual Basic), T1204.002 (Malicious File)
* **Persistence:** T1053.005 (Scheduled Task)
* **Defense Evasion:** T1027.013 (Encrypt/Encode File), T1070.004 (File Deletion), T1140 (Deobfuscate/Decode)
* **Discovery:** T1083 (File and Directory Discovery)
* **Collection:** T1074.001 (Local Data Staging)
* **Command and Control:** T1071.001 (Web Protocols), T1105 (Ingress Tool Transfer)
* **Exfiltration:** T1041 (Exfiltration Over C2 Channel), T1567.004 (Exfiltration Over Webhook)
## Targeting
* **Sectors:** Diplomatic organizations, defense manufacturing, and government agencies.
* **Geography:** Romania, Spain, and Türkiye.
* **Victims:** Spanish Ministry of the Presidency, Justice and Relations with the Cortes (impersonated).
## Tools & Infrastructure
* **Malware Families:**
* **HOOKEDGE:** A lightweight batch-script backdoor (primary tool in recent campaigns).
* **HEADLACE:** A predecessor backdoor with significant code overlap used in 2023 campaigns.
* **Infrastructure:**
* **C2/Exfiltration:** Extensive use of `webhook[.]site`.
* **Payload Staging:** Legitimate Internet Services (LIS) to reduce operational overhead.
## Implications
BlueDelta continues to demonstrate high operational resilience by favoring "low-tech" but highly adaptable batch-based tooling over complex custom malware. By abusing legitimate web services, they effectively bypass traditional signature-based detections and blend into standard enterprise network traffic. Their focus remains aligned with Russian strategic intelligence requirements, specifically regarding European defense and diplomatic posture.
## Mitigations
* **Macro Security:** Implement strict policies to block the execution of macros in Microsoft Office documents originating from the internet.
* **Endpoint Monitoring:** Implement detection coverage for the creation and modification of **Scheduled Tasks** (T1053.005) and the execution of **headless browser processes** (e.g., Microsoft Edge).
* **Network Filtering:** Monitor and potentially restrict outbound connections to public webhook services (e.g., `webhook[.]site`) if they are not required for legitimate business processes.
* **User Training:** Enhance spearphishing awareness, specifically regarding diplomatic-themed lures and requests to "Enable Content" in Word documents.