Verticals Targeted: Government, Diplomacy, Defense Manufacturing
Regions Targeted: Romania, Spain, Turkey, Europe
Related Malware: HEADLACE
Executive Summary
Russian state-sponsored threat group BlueDelta deployed the HOOKEDGE Windows backdoor in espionage campaigns targeting European diplomatic, government, and defense-related organizations. Delivered through macro-enabled Microsoft Word documents, HOOKEDGE uses scheduled tasks, Microsoft Edge, and legitimate webhook services for C2, payload staging, and data exfiltration. The campaigns demonstrate BlueDelta’s continued refinement of established tradecraft to evade detection, minimize infrastructure requirements, and selectively escalate activity against targets assessed as having higher intelligence value.
