Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
APT28 HOOKEDGE Backdoor Abuses Microsoft Edge and webhook.site for C2 and Data Exfiltration
Threat Actors
Excerpt
Russian state-linked threat actor BlueDelta, also known as APT28, Fancy Bear, and Forest Blizzard, has launched phishing campaigns using a lightweight Windows backdoor called HOOKEDGE. The activity targeted government, diplomatic, and defense manufacturing organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. Insikt Group assessed with moderate confidence that BlueDelta conducted the activity. The assessment is based on code,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://webhook.site/62114596-33f5-47fb-9012-0223529e5a13/docopened.jpg | High | Score 58/100 | First seen |
| URL | http://webhook.site/1e72b758-79e4-4c1c-90ed-7a8dc118f105 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…