APT28, the Russian nation-state threat actor, is using lures related to the Israel-Hamas war to distribute the HeadLace backdoor.

APT28, the Russian nation-state threat actor, is using lures related to the Israel-Hamas war to distribute the HeadLace backdoor.

As of December 2023, IBM X-Force has uncovered multiple lure documents featuring the Israel-Hamas war to facilitate delivery of the ITG05 Headlace malware. Explore the findings.

APT28, the Russian nation-state threat actor, is using lures related to the Israel-Hamas war to distribute the HeadLace backdoor.

Discover BlueDelta’s (APT28, FANCY BEAR, Forest Blizzard) strategic espionage tactics in Europe. Learn more.

Insikt Group identified BlueDelta initial access campaigns from late September 2025 to early April 2026 that targeted government and diplomatic organizations in Romania, Spain, and Türkiye using macro-enabled Word documents to deliver the HOOKEDGE backdoor. HOOKEDGE relies on webhook[.]site, Microsoft Edge, scheduled tasks, and staged batch-script execution, and the activity overlaps heavily with the earlier HEADLACE malware and the BlueDelta cluster associated with APT28, Fancy Bear, and Forest Blizzard. #BlueDelta #HOOKEDGE #HEADLACE #APT28 #FancyBear #ForestBlizzard #webhooksite

The BlueDelta group has used macro-laced Word documents to distribute HOOKEDGE, a batch-script backdoor that leverages webhook.site for command and control. Campaigns have been active since September 2025.

The scheme from the group also known as APT28 involves targeting Eastern European diplomats in need of personal transportation, tempting them with a purported good deal on a Audi Q7 Quattro SUV.

A Russia-linked APT used a car for sale as a phishing lure to deliver a modular Windows backdoor called HeadLace.

A Russia-linked threat actor, APT28, is using a car-for-sale phishing lure to deliver a new Windows backdoor called HeadLace.

Russia-linked APT28 used the HeadLace malware and credential-harvesting web pages in attacks against networks across Europe.

Russian GRU-backed threat actor APT28 is behind campaigns targeting networks across Europe with HeadLace malware and credential-harvesting web pages.

As of December 2023, IBM X-Force has uncovered multiple l...

Fighting Ursa, a Russian APT, employed a car sales phishing lure to distribute the HeadLace backdoor malware targeting diplomats since

The scheme from the group also known as APT28 involves targeting Eastern European diplomats in need of personal transportation and tempting them with a purported good deal on a Audi Q7 Quattro SUV.