Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Brief
BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments.
Recorded Future’s Insikt Group documented a campaign by BlueDelta , the Russian GRU-linked group that overlaps with the group APT28 , running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone.
The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.