other

BlueDelta

Russian state-sponsored threat group attributed to the GRU, tracked by Recorded Future as BlueDelta and overlapping with activity publicly known as APT28, Fancy Bear and Forest Blizzard; more than a decade of espionage operations against government, diplomatic, defense and policy targets.

Known aliases

APT28

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 distinct publisher

Insikt Group traces six months of Word macro lures on three governments to GRU's BlueDelta

The new backdoor, HOOKEDGE, is a Windows batch script that beacons to a free webhook.site endpoint. Insikt Group calls the BlueDelta attribution moderate confidence, resting on overlap with the older HEADLACE implant.

Publishers:recordedfuture.com

Reality

Evidence56
Adoption42
Hype gap+8
Incentives62