APT28 deploys Hookedge backdoor to target NATO defense contractors and law enforcement in Europe

Russian state-sponsored group APT28, also known as Fancy Bear, BlueDelta, and Forest Blizzard, used a backdoor called Hookedge to compromise defense contractors and a law enforcement agency in two NATO allied countries in Europe. The campaign began with a phishing lure impersonating a September 8, 2025 meeting agenda from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, timed near Moldova’s parliamentary elections on September 28, 2025. Researchers attribute the deployment of Hookedge between late September 2025 and at least April 2026, targeting government ministries, diplomatic missions, and defense manufacturers in Romania, Spain, and Turkey.

Hookedge is a Windows batch-script backdoor that exploits Microsoft Edge to send and receive data, disguising its activity as normal web browsing. The malware extends its first-stage beaconing interval to 61 minutes, a tactic designed to evade automated sandbox environments that typically monitor files for only 60 minutes before classifying them as benign. Researchers also noted that APT28 used webhook.site, a free developer utility, to route command-and-control traffic, further complicating detection efforts.

Over the course of the campaign, APT28 introduced at least six modifications to Hookedge, including transitioning from diplomatic lures to generic prompts and using SendKeys automation to bypass macro-activation security prompts. Hookedge represents an evolutionary step for APT28, building on its previous backdoor, HEADLACE, which has been used since at least April 2023. The group’s iterative approach to refining existing tools rather than developing entirely new capabilities underscores its operational adaptability.

In April 2026, APT28 further expanded its tactics by exploiting vulnerabilities in internet routers to redirect web traffic and spy on victims, as warned by British security officials. In July 2026, the group targeted a naval shipbuilder in one NATO ally after an employee opened a malicious Microsoft Word document. This led to credential theft and network exploration, with the attackers deploying an undocumented tool to decrypt and execute malicious code in memory. While researchers could not confirm whether sensitive information was stolen, the nature of the targets suggests defense-related data was the objective.

APT28’s targeting aligns with broader Russian intelligence-gathering efforts, as assessed by Symantec researchers. The group has conducted cyber-espionage operations against military, government, and defense organizations in Europe and North America for over a decade, including the 2016 hack of the Democratic National Committee. Western cybersecurity agencies have repeatedly warned of APT28’s activities, particularly its focus on defense and military logistics organizations supporting Ukraine. A joint advisory by over 20 Western intelligence and cybersecurity agencies in 2025 accused APT28 of targeting logistics providers and technology companies involved in delivering foreign assistance.

Russia’s broader sabotage campaign against European defense supply chains reflects a strategic effort to degrade Ukraine’s support networks while staying below NATO’s Article 5 threshold. In April 2026, Russia’s Defence Ministry published a list of 21 European defense entities, framing their host nations as Ukraine’s ‘strategic rear.’ This public declaration provided a blueprint for targeting, including 11 European branches of Ukrainian drone manufacturers and 10 foreign producers of drone components. Between August 10 and September 3, 2026, a six-week sabotage cluster struck drone manufacturers, munitions facilities, and defense electronics firms across five NATO states, including Poland, Latvia, Slovakia, Bulgaria, and Germany.

Russia’s sabotage tactics extend beyond cyber operations to include proxy recruitment models, as documented by Denmark’s PET intelligence service in September 2026. The group operates through social media and gaming platforms to recruit local nationals for surveillance and sabotage, escalating them from low-risk tasks like photographing buildings to direct actions such as arson. Germany’s BfV has designated the security and defense sector as a ‘target surface’ for Russian state entities and proxies, framing companies, supply chains, and executives as components of Ukraine’s ‘military support space.’

NATO is responding to these threats with accelerated preparations, particularly along its eastern flank. Germany has established a permanent brigade in Lithuania and reinforced command structures in Estonia and Latvia, while exercises like Steadfast Deterrence 2026 and BALTOPS 2026 simulate attacks on critical infrastructure. Estonia’s Foreign Intelligence Service assessed in 2026 that Russia has no immediate plans to attack Estonia or another NATO member but is rebuilding military capabilities for future conflicts, warning of potential drone-based attacks across land, air, and maritime domains.