BlueDelta Targets Defense and Diplomacy with HOOKEDGE

    Date: 09/09/2026

    Severity: High

    Summary

    BlueDelta (APT28/Fancy Bear), a Russian state-sponsored GRU-linked threat actor, targeted government, diplomatic, and defense organizations in Romania, Spain, and Türkiye between September 2025 and April 2026. The group used macro-enabled Word documents with diplomatic-themed lures to deliver HOOKEDGE, a lightweight batch-script backdoor closely related to HEADLACE. HOOKEDGE abuses legitimate webhook services for C2, payload staging, and data exfiltration, allowing the activity to blend with legitimate traffic while supporting Russian intelligence collection. 

    Indicators of Compromise (IOC) List 

    Domains/URLs

    http://webhook.site/1e72b758-79e4-4c1c-90ed-7a8dc118f105

    http://webhook.site/62114596-33f5-47fb-9012-0223529e5a13/docopened.jpg

    http://webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/docopened.jpg

    http://webhook.site/c1d8ba4a-f044-4454-8b1c-b6866518f92c/doc.jpg

    http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/docopened.jpg

    http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/mailopened.jpg

    http://webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/docopened.jpg

    http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/docopened.jpg

    http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/mailopened.jpg

    https://webhook.site/01d6a811-ae9a-4ecb-be3f-610075556304

    https://webhook.site/272f1315-14d7-458c-a4ca-e2df423490b4

    https://webhook.site/34f908b6-dd89-4600-b413-a29cd5e37a0b

    https://webhook.site/36c9aecd-19f5-4564-a354-7708d947da8e

    https://webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d

    https://webhook.site/4e81a907-cc30-45c0-8bbd-5248e9f6dacd

    https://webhook.site/4ef62d6a-90c0-4a70-8dd2-468879c70fd6

    https://webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af

    https://webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba

    https://webhook.site/655a413e-4a66-4987-8f5b-f5cbfe34cdd6

    https://webhook.site/68ff1679-974b-4d15-9ce0-799892c63f04

    https://webhook.site/752c57b9-20d1-4990-a909-fd212ab71dcd

    https://webhook.site/81f3d140-eb6e-4d72-a6ca-e6e952c3d9c2

    https://webhook.site/82911ae6-ea27-4996-a664-2322e89da9ae

    https://webhook.site/9f2837e2-8321-46a5-aee5-ccdda349f864

    https://webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee

    https://webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d

    https://webhook.site/bbdbf60c-8593-4660-9620-d3c0de24a8ab

    https://webhook.site/c24a31e4-691e-4a7b-96af-037ae735d358

    https://webhook.site/cf25f91c-0a20-4339-834f-02f73e8bc75e

    https://webhook.site/d993e113-a672-48aa-a382-64c5aaac56eb

    Hash

    001b57368c10bee9e62374e3b3f232b113eb75a1f198243d43a5bb90e1d0f500

    206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991

    231164362b2e4688e5d64ef7154845d655b649470bf995a79107b800ac5663b1

    2793e7caba2f9beecd9b01baf41b8cb79f5a1a083ddedc6602ff23996bdc3104

    2e320c457658d35a2bb7c420c53bdcc3916f01a7dd4572e5540e8fce923d201b

    2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a

    38f0e1e00d5c6d4afd96217556ba1dbe963298be4f9f0890fc1a7618bed009bd

    58cfb8b9fee1caa94813c259901dc1baa96bae7d30d79b79a7d441d0ee4e577e

    5f2a06bb1d1a210e9c477e4e5db439ce7b11fe9345d39b1b959905ba576a076a

    74456a8d6042a4232071bee99e25d23046b993486d6d8a98ab296915bbb53395

    7d8e98c0e322110021ae6d89f1a3ea090ef0741cf35b040dd4d0426a502d4845

    877648c6ff448aa4efe1e3f004c089411285b8cb4139320e0dbec9d1d1bb3c77

    87c15e4cf30098dcbfe9fd506c42896bf6d856aa77a70f312dd621b443b61dc3

    8f18e02cbe1fa7abd280d2e070efe7af07e20cfe635f81140d6d347c292f8f44

    9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc

    9c02d5429717001c55420730ee345c172e7ed89df3052b1e32b9bd122fce616d

    aebf896b2f60c52af5d38c036159e0243632134643e8ad374cb64ed8cb09f360

    b0f9f0a34ccab1337fbcca24b4f894de8d6d3a6f5db2e0463e2320215e4262e4

    b1d037e9ff070d9722b7b289629d9b64a08ec35fd843cc01d37e6db69781ddcb

    b8a1494b68617de92a3f58af8ca49dda4e9894f24c718ff3b26897a340e45c80

    bfc008f57dca8c6bf341d9d7cf66cdad53faf8b1bcfbeded4593a60f129174b6

    c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44

    c6db004f2e8ff321d8a0e6d0134f2737d0f6ff79a4627a4b803ef926c107aa00

    df60fa6008b1a0b79c394b42d3ada6bab18b798f3c2ca1530a3e0cb4fbbbe9f6

    ed8f20bbab18b39a67e4db9a03090e5af8dc8ec24fe1ddf3521b3f340a8318c1

    f611e5415e21f229f75a42011d092e781ffe4118bb70ac95b9d85c41c81ef6ca

     

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "https://webhook.site/d993e113-a672-48aa-a382-64c5aaac56eb" or url like "https://webhook.site/d993e113-a672-48aa-a382-64c5aaac56eb" or siteurl like "https://webhook.site/d993e113-a672-48aa-a382-64c5aaac56eb" or domainname like "https://webhook.site/cf25f91c-0a20-4339-834f-02f73e8bc75e" or url like "https://webhook.site/cf25f91c-0a20-4339-834f-02f73e8bc75e" or siteurl like "https://webhook.site/cf25f91c-0a20-4339-834f-02f73e8bc75e" or domainname like "https://webhook.site/36c9aecd-19f5-4564-a354-7708d947da8e" or url like "https://webhook.site/36c9aecd-19f5-4564-a354-7708d947da8e" or siteurl like "https://webhook.site/36c9aecd-19f5-4564-a354-7708d947da8e" or domainname like "https://webhook.site/bbdbf60c-8593-4660-9620-d3c0de24a8ab" or url like "https://webhook.site/bbdbf60c-8593-4660-9620-d3c0de24a8ab" or siteurl like "https://webhook.site/bbdbf60c-8593-4660-9620-d3c0de24a8ab" or domainname like "http://webhook.site/62114596-33f5-47fb-9012-0223529e5a13/docopened.jpg" or url like "http://webhook.site/62114596-33f5-47fb-9012-0223529e5a13/docopened.jpg" or siteurl like "http://webhook.site/62114596-33f5-47fb-9012-0223529e5a13/docopened.jpg" or domainname like "http://webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/docopened.jpg" or url like "http://webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/docopened.jpg" or siteurl like "http://webhook.site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/docopened.jpg" or domainname like "https://webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af" or url like "https://webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af" or siteurl like "https://webhook.site/5744c020-a8d9-4755-abfb-cde6ccd450af" or domainname like "https://webhook.site/9f2837e2-8321-46a5-aee5-ccdda349f864" or url like "https://webhook.site/9f2837e2-8321-46a5-aee5-ccdda349f864" or siteurl like "https://webhook.site/9f2837e2-8321-46a5-aee5-ccdda349f864" or domainname like "http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/docopened.jpg" or url like "http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/docopened.jpg" or siteurl like "http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/docopened.jpg" or domainname like "https://webhook.site/82911ae6-ea27-4996-a664-2322e89da9ae" or url like "https://webhook.site/82911ae6-ea27-4996-a664-2322e89da9ae" or siteurl like "https://webhook.site/82911ae6-ea27-4996-a664-2322e89da9ae" or domainname like "https://webhook.site/752c57b9-20d1-4990-a909-fd212ab71dcd" or url like "https://webhook.site/752c57b9-20d1-4990-a909-fd212ab71dcd" or siteurl like "https://webhook.site/752c57b9-20d1-4990-a909-fd212ab71dcd" or domainname like "https://webhook.site/272f1315-14d7-458c-a4ca-e2df423490b4" or url like "https://webhook.site/272f1315-14d7-458c-a4ca-e2df423490b4" or siteurl like "https://webhook.site/272f1315-14d7-458c-a4ca-e2df423490b4" or domainname like "http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/mailopened.jpg" or url like "http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/mailopened.jpg" or siteurl like "http://webhook.site/d63049e3-1cbe-474b-9005-237517af53a7/mailopened.jpg"

    Detection Query 2 :

    domainname like "https://webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee" or url like "https://webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee" or siteurl like "https://webhook.site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee" or domainname like "https://webhook.site/655a413e-4a66-4987-8f5b-f5cbfe34cdd6" or url like "https://webhook.site/655a413e-4a66-4987-8f5b-f5cbfe34cdd6" or siteurl like "https://webhook.site/655a413e-4a66-4987-8f5b-f5cbfe34cdd6" or domainname like "https://webhook.site/68ff1679-974b-4d15-9ce0-799892c63f04" or url like "https://webhook.site/68ff1679-974b-4d15-9ce0-799892c63f04" or siteurl like "https://webhook.site/68ff1679-974b-4d15-9ce0-799892c63f04" or domainname like "https://webhook.site/c24a31e4-691e-4a7b-96af-037ae735d358" or url like "https://webhook.site/c24a31e4-691e-4a7b-96af-037ae735d358" or siteurl like "https://webhook.site/c24a31e4-691e-4a7b-96af-037ae735d358" or domainname like "https://webhook.site/01d6a811-ae9a-4ecb-be3f-610075556304" or url like "https://webhook.site/01d6a811-ae9a-4ecb-be3f-610075556304" or siteurl like "https://webhook.site/01d6a811-ae9a-4ecb-be3f-610075556304" or domainname like "https://webhook.site/34f908b6-dd89-4600-b413-a29cd5e37a0b" or url like "https://webhook.site/34f908b6-dd89-4600-b413-a29cd5e37a0b" or siteurl like "https://webhook.site/34f908b6-dd89-4600-b413-a29cd5e37a0b" or domainname like "https://webhook.site/81f3d140-eb6e-4d72-a6ca-e6e952c3d9c2" or url like "https://webhook.site/81f3d140-eb6e-4d72-a6ca-e6e952c3d9c2" or siteurl like "https://webhook.site/81f3d140-eb6e-4d72-a6ca-e6e952c3d9c2" or domainname like "http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/mailopened.jpg" or url like "http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/mailopened.jpg" or siteurl like "http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/mailopened.jpg" or domainname like "http://webhook.site/1e72b758-79e4-4c1c-90ed-7a8dc118f105" or url like "http://webhook.site/1e72b758-79e4-4c1c-90ed-7a8dc118f105" or siteurl like "http://webhook.site/1e72b758-79e4-4c1c-90ed-7a8dc118f105" or domainname like "http://webhook.site/c1d8ba4a-f044-4454-8b1c-b6866518f92c/doc.jpg" or url like "http://webhook.site/c1d8ba4a-f044-4454-8b1c-b6866518f92c/doc.jpg" or siteurl like "http://webhook.site/c1d8ba4a-f044-4454-8b1c-b6866518f92c/doc.jpg" or domainname like "https://webhook.site/4e81a907-cc30-45c0-8bbd-5248e9f6dacd" or url like "https://webhook.site/4e81a907-cc30-45c0-8bbd-5248e9f6dacd" or siteurl like "https://webhook.site/4e81a907-cc30-45c0-8bbd-5248e9f6dacd" or domainname like "https://webhook.site/4ef62d6a-90c0-4a70-8dd2-468879c70fd6" or url like "https://webhook.site/4ef62d6a-90c0-4a70-8dd2-468879c70fd6" or siteurl like "https://webhook.site/4ef62d6a-90c0-4a70-8dd2-468879c70fd6" or domainname like "https://webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba" or url like "https://webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba" or siteurl like "https://webhook.site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba" or domainname like "http://webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/docopened.jpg" or url like "http://webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/docopened.jpg" or siteurl like "http://webhook.site/c2e1be16-401b-4f60-8a0f-276b30417fda/docopened.jpg" or domainname like "https://webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d" or url like "https://webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d" or siteurl like "https://webhook.site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d" or domainname like "http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/docopened.jpg" or url like "http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/docopened.jpg" or siteurl like "http://webhook.site/c29905ab-e5fa-446c-8958-4eab15d8fb80/docopened.jpg" or domainname like "https://webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d" or url like "https://webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d" or siteurl like "https://webhook.site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d"

    Detection Query 3 :

    sha256hash IN ("2793e7caba2f9beecd9b01baf41b8cb79f5a1a083ddedc6602ff23996bdc3104","aebf896b2f60c52af5d38c036159e0243632134643e8ad374cb64ed8cb09f360","ed8f20bbab18b39a67e4db9a03090e5af8dc8ec24fe1ddf3521b3f340a8318c1","f611e5415e21f229f75a42011d092e781ffe4118bb70ac95b9d85c41c81ef6ca","87c15e4cf30098dcbfe9fd506c42896bf6d856aa77a70f312dd621b443b61dc3","b0f9f0a34ccab1337fbcca24b4f894de8d6d3a6f5db2e0463e2320215e4262e4","231164362b2e4688e5d64ef7154845d655b649470bf995a79107b800ac5663b1","5f2a06bb1d1a210e9c477e4e5db439ce7b11fe9345d39b1b959905ba576a076a","2e320c457658d35a2bb7c420c53bdcc3916f01a7dd4572e5540e8fce923d201b","206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991","001b57368c10bee9e62374e3b3f232b113eb75a1f198243d43a5bb90e1d0f500","2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a","74456a8d6042a4232071bee99e25d23046b993486d6d8a98ab296915bbb53395","df60fa6008b1a0b79c394b42d3ada6bab18b798f3c2ca1530a3e0cb4fbbbe9f6","9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc","b1d037e9ff070d9722b7b289629d9b64a08ec35fd843cc01d37e6db69781ddcb","c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44","58cfb8b9fee1caa94813c259901dc1baa96bae7d30d79b79a7d441d0ee4e577e","38f0e1e00d5c6d4afd96217556ba1dbe963298be4f9f0890fc1a7618bed009bd","7d8e98c0e322110021ae6d89f1a3ea090ef0741cf35b040dd4d0426a502d4845","877648c6ff448aa4efe1e3f004c089411285b8cb4139320e0dbec9d1d1bb3c77","8f18e02cbe1fa7abd280d2e070efe7af07e20cfe635f81140d6d347c292f8f44","9c02d5429717001c55420730ee345c172e7ed89df3052b1e32b9bd122fce616d","b8a1494b68617de92a3f58af8ca49dda4e9894f24c718ff3b26897a340e45c80","bfc008f57dca8c6bf341d9d7cf66cdad53faf8b1bcfbeded4593a60f129174b6","c6db004f2e8ff321d8a0e6d0134f2737d0f6ff79a4627a4b803ef926c107aa00")

    Reference:    

    https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge                                            


    Tags

    MalwareThreat ActorAPT28Fancy BearRussiaAPTRussian GRUGovernment Services and FacilitiesDefense Industrial BaseSpainTurkeyBackdoorExfiltration

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags