Insikt Group traces six months of Word macro lures on three governments to GRU's BlueDelta

HOOKEDGE's architecture is inherited. Insikt Group's link to BlueDelta rests on code and tradecraft overlap with HEADLACE, the backdoor the group used in earlier campaigns, plus consistent infrastructure patterns and targeting that matches Russian collection requirements ^[5]. Recorded Future rates that moderate confidence and says so in the assessment itself ^[4].

The delivery path is unglamorous: a macro-enabled Word document, a user who enables content, a batch file on disk ^[2]. Insikt's detection guidance names scheduled task abuse, headless Microsoft Edge execution and outbound connections to webhook services, which is where the chain touches the host and the wire ^[11].

The C2 is a developer testing utility. Every stage ran through webhook[.]site's free tier, the group's exclusive choice across these campaigns for command-and-control, payload staging and exfiltration ^[10]. That removes the dedicated infrastructure a responder would normally seize or blocklist, and it lets the traffic sit alongside legitimate requests ^[6].

The free tier also constrained the operators. Insikt attributes part of the implant's evolution to reduced free-tier API limits on webhook[.]site, alongside sandbox evasion ^[7]. The tiered beaconing follows from that: only targets assessed as having higher intelligence value received a second-stage payload with a much shorter interval, which kept the initial-access endpoints from being exhausted ^[9].

Late September 2025 to early April 2026 works out to roughly 187 days ^[17]. Across that window the changes were to lure documents, execution methods and beaconing intervals, with core functionality and the infrastructure model left alone ^[8]. Early lures impersonated Spanish government material; later ones dropped the pretext and simply asked users to enable macros ^[14]. Insikt reads this as refinement of existing tradecraft rather than new capability ^[12], which is consistent with a group that has been running espionage operations of this type for more than a decade ^[15].

The Spanish lure is the one with a calendar attached. It impersonated Spain's Ministry of the Presidency, Justice and Relations with the Cortes and was created shortly after a September 2025 meeting between Spanish and Moldovan officials ^[3]. Insikt raises Moldova's September 2025 parliamentary elections as a possible collection driver, and frames it as a possibility rather than a finding ^[18].

What the published summary does not carry is a victim count, or a statement that any organization in the three countries was successfully compromised ^[16]. Defense manufacturing sits in the target set alongside diplomatic bodies ^[13]. The mitigation list is cheap by the standards of GRU tooling: block macro execution for internet-originated documents, then alert on three behaviours a normal endpoint does not produce ^[11]. The variable that moved this implant twice was a SaaS provider's rate limit.