Espionage Campaign by BlueDelta Targets European Governments: A Detailed Overview
A recent report by Recorded Future’s Insikt Group has unveiled a meticulous espionage campaign orchestrated by BlueDelta, a threat group with links to Russia’s GRU. This group is known to operate in conjunction with APT28, and their malicious activities spanned from late September 2025 to early April 2026. The prime targets of this campaign were governmental and diplomatic organizations located in Romania, Spain, and Turkey. Employing a backdoor known as HOOKEDGE, the attackers executed their strategy using a lightweight Windows batch-script delivered through macro-enabled Microsoft Word documents. Notably, they utilized webhook.site, a recognized developer testing service, as the backbone of their command-and-control infrastructure.
Initial Phishing Tactics
The initial phase of the infection relied heavily on sophisticated phishing techniques involving documents crafted with themes resonating with diplomatic contexts. One particular set of documents impersonated Spain’s Ministry of the Presidency, Justice, and Relations with the Cortes. The timing of these phishing attempts was particularly striking; they were launched shortly after a September 2025 meeting between officials from Spain and Moldova, coinciding with Moldova’s parliamentary elections. This clever timing exemplified the attackers’ strategic planning, as they aimed to enhance the effectiveness of their lures.
Furthermore, these malicious documents contained hidden tracking pixels, deceptively named as mailopened.jpg and docopened.jpg. These served the purpose of allowing operators to monitor critical engagements—such as when emails were opened, when documents were accessed, and when macros were executed—providing valuable intelligence on potential victims’ interactions.
Functionality of HOOKEDGE
HOOKEDGE, the primary tool utilized in this espionage campaign, operates via a deceptively simple but efficient design consisting of two webhook endpoints. One endpoint is dedicated to receiving commands, while the other focuses on exfiltrating data that has been stolen. A notable feature of HOOKEDGE is its ability to create a scheduled task that queries command files every 30 minutes using Microsoft Edge. This design not only supports command execution but also facilitates the sending of collected results back to the attackers.
What stands out about this malware is its ability to disguise itself amidst regular enterprise web traffic. Unlike traditional malware that relies on custom binaries or widely understood living-off-the-land tools, HOOKEDGE mimics typical browser activity, making it less detectable. Interestingly, it shares significant code similarities with HEADLACE, another tool previously associated with BlueDelta, indicating a direct evolutionary development by the same group of operators.
Advanced Operational Strategies
In terms of operational tactics, BlueDelta has adopted a two-tiered structure for prioritizing its targets. High-value victims received a secondary HOOKEDGE payload that was designed to check in every five minutes, rather than the standard thirty. This adjustment not only provided faster interactive control but also circumvented webhook.site’s limitations associated with its free tier, which restricts users to 100 requests per endpoint. By distributing routine and high-priority tasks across separate endpoints, BlueDelta was able to maintain operational efficiency.
Moreover, the group demonstrated an understanding of cybersecurity precautions by continuously refining its operational strategies. They lengthened beaconing intervals from 30 to 61 minutes to elude sandbox analysis tools that typically monitor samples only for an hour. This adaptation is a clear indication of the group’s awareness of the evolving landscape of cybersecurity.
Defense Measures
Defensive strategies against this insidious campaign have been advised. Organizations are urged to block the execution of macros in documents received from the internet and to monitor scheduled tasks that spawn script interpreters from user-writable directories. Additionally, any instances of Microsoft Edge operating in headless mode or making automated connections to file-sharing and webhook services—especially those not associated with legitimate business activities—should be flagged for further review.
Conclusion
Recorded Future assesses that BlueDelta is likely to persist in targeting European government and diplomatic entities, primarily driven by its strategic interests relating to European governance, NATO affairs, and diplomatic relations with former Soviet republics. As cyber warfare continues to evolve, the need for robust cybersecurity measures has never been more pressing. Organizations must remain vigilant and adapt to the ever-changing tactics of such sophisticated threat actors as BlueDelta to safeguard their sensitive information and operations.