Insikt Group reveals how GRU-linked BlueDelta evolved credential-harvesting campaigns targeting government, energy, and research organizations across Europe and Eurasia.

Discover how the Russian state-sponsored threat group BlueDelta is using the HOOKEDGE backdoor to target defense and diplomatic organizations across Europe

YouTube video by BlueDelta

Discover how Russia’s BlueDelta targets UKR.NET users with advanced credential-harvesting campaigns, evolving tradecraft, and multi-stage phishing techniques.

Executives and network defenders should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and IOCs, and posture network defenses with a presu...

Russian BlueDelta hackers ran phishing campaign against Ukrainian webmail users

TAG-110, a Russia-aligned threat group, targets organizations across Asia and Europe using HATVIBE and CHERRYSPY malware for espionage. Learn how Recorded Future's analysis uncovers the group’s tactic...

Insikt Group reveals how GRU-linked BlueDelta evolved credential-harvesting campaigns targeting government, energy, and research organizations across Europe and Eurasia.

Russia-aligned TAG-110 shifts to .dotm phishing lures in a 2025 campaign against Tajikistan’s public sector, advancing cyber-espionage in Central Asia.

BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments. Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as […]

Insikt Group identified BlueDelta initial access campaigns from late September 2025 to early April 2026 that targeted government and diplomatic organizations in Romania, Spain, and Türkiye using macro-enabled Word documents to deliver the HOOKEDGE backdoor. HOOKEDGE relies on webhook[.]site, Microsoft Edge, scheduled tasks, and staged batch-script execution, and the activity overlaps heavily with the earlier HEADLACE malware and the BlueDelta cluster associated with APT28, Fancy Bear, and Forest Blizzard. #BlueDelta #HOOKEDGE #HEADLACE #APT28 #FancyBear #ForestBlizzard #webhooksite

Researchers said the campaign likely aimed to collect sensitive information from Ukrainian users in support of broader Russian intelligence objectives.