Table of Contents
Cybercrime continues to reinvent itself, and the Russian hackers of BlueDelta are proof of that. This group, also known as Fancy Bear, uses a sophisticated infiltration technique to target diplomatic and governmental organizations in Europe. Their latest tool, HOOKEDGE, is a backdoor that cleverly hides behind legitimate web services to steal valuable information.
Key takeaways
Imagine a world where a simple Word document could be the key to a vast espionage network. You open an apparently innocuous file, and unknowingly, you have just delivered your organization’s secrets. This is exactly the strategy adopted by BlueDelta, exploiting our trust in familiar digital tools to infiltrate sensitive systems.
BlueDelta, also known as APT28 or Fancy Bear, is a cyber-espionage group renowned for its large-scale attacks. Between September 2025 and July 2026, Recorded Future researchers closely monitored their activities. The group targeted diplomatic entities in Romania, Spain, and Turkey, using malicious Word documents that mimicked official documents to deceive their victims.
The attacks begin with a phishing email containing a Word document with malicious macros. Once opened, these macros executed scripts that installed a scheduled task on the victim’s computer. This task relaunched the program regularly while deleting its traces to avoid detection.
HOOKEDGE stands out for its data extraction method. The program uses Microsoft Edge to connect to an address hosted by webhook.site, a service normally used by developers to test web requests. By using a legitimate browser, hackers complicate the task of security tools that often rely on domain reputation to detect anomalies.
The program operates in cycles, retrieving instructions and executing commands on the infected machine. The data is then exfiltrated via another Edge connection, making the process difficult to trace. This strategy of separation between receiving orders and data exfiltration minimizes risks in case of partial detection.
Researchers observed that HOOKEDGE adapts its methods based on the importance of the target. For example, a standard instance of HOOKEDGE contacts its operators every 30 minutes, while on priority targets, this interval can be reduced to five minutes. This variation allows bypassing automated sandboxes that generally observe a file for only an hour.
Recorded Future also discovered a link between HOOKEDGE and an older backdoor from the same group, called HEADLACE. This continuity in techniques demonstrates the evolution of cybercriminal tools used by BlueDelta to adapt to new cybersecurity defenses.
Trapped Word documents represent a persistent threat in today’s cybersecurity landscape. These files, often used for phishing attacks, rely on users’ familiarity and trust in common file formats. Companies must be extra vigilant and train their employees to recognize phishing signs to avoid falling victim to such attacks.
In a context where digital collaboration tools are ubiquitous, organizations must implement robust strategies to protect their systems against threats hidden in seemingly harmless documents. This includes using advanced security software capable of detecting anomalies in files and preventing the execution of unauthorized macros.
Cybersecurity in Europe faces many challenges due to persistent attacks from groups like BlueDelta. With increasing geopolitical tensions, espionage attacks increasingly target critical infrastructures and governmental institutions. European countries must collaborate to strengthen their defenses and share information on emerging threats.
Initiatives like the European Union Agency for Cybersecurity (ENISA) play a crucial role in supporting collaborative efforts and providing resources to improve system resilience. However, combating cyberattacks requires a proactive approach and continuous monitoring to adapt to the sophisticated tactics of cybercriminals.
What is the main method used by BlueDelta to infiltrate systems?
BlueDelta uses trapped Word document attachments, containing malicious macros, to infiltrate the systems of targeted organizations.
How does HOOKEDGE use Microsoft Edge for its operations?
HOOKEDGE opens a hidden instance of Microsoft Edge to receive instructions from an address hosted by webhook.site and exfiltrate collected data through another Edge connection.
Which countries have been targeted by BlueDelta in their latest campaign?
The targeted countries include Romania, Spain, and Turkey, where diplomatic and governmental organizations have been targeted.
How can companies protect themselves against trapped Word documents?
Companies must enhance employee training on recognizing phishing attempts and use advanced security software to detect malicious macros in documents.