← threat actors
threat actor · RU
APT28
also tracked as bluedelta 1
related, not merged: APT29 2
5 stories · 4 in the wild · July 4, 2026 – October 21, 2026
evidence: 4 observed · 1 demonstrated
how they got in
- phishing email 4 · Oct 21
sectors
- defense 1 · Oct 21
- manufacturing 1 · Oct 21
- government 1 · Aug 28
- consumers 1 · Jul 26
geography
- nato 1 · Oct 21
- romania 1 · Aug 28
- spain 1 · Aug 28
- turkey 1 · Aug 28
malware and tools
- hookedge 2 · Oct 21
- covenant grunt 1 · Oct 20
techniques
- phishing 2 · Oct 20
- persistence 1 · Oct 21
- spear phishing 1 · Oct 21
- execution 1 · Oct 20
- reconnaissance 1 · Oct 20
- backdoor 1 · Aug 28
- macro enabled documents 1 · Aug 28
- social engineering 1 · Aug 28
- dns poisoning 1 · Jul 26
- oauth token theft 1 · Jul 26
- wpad abuse 1 · Jul 26
- process hijacking 1 · Jul 4
attack phases seen
- Initial access 4 · Oct 21
- Execution 3 · Oct 21
- Persistence 2 · Oct 21
- Command and control 1 · Aug 28
- Credential access 1 · Jul 26
- Defense evasion 1 · Jul 4
what we reported, newest first, grouped by story
October 21, 2026
- APT28 breached defense-sector targets in two unnamed NATO countries. Symantec’s Swallowtail cluster targeted a naval shipbuilder, military-aircraft engine manufacturer and law-enforcement agency. One July intrusion began with a malicious Word attachment, deployed HOOKEDGE, and later introduced an undocumented reflective loader that decrypted and executed code in memory. Activity ran from July 24 through at least September 24; sensitive-data theft and uninterrupted persistence were not confirmed, according to The Record.
· Oct 21 · observed · via phishing email · Threat Activity
October 20, 2026
- Nextron attributes seven malicious Office documents submitted between July 8 and July 14 to APT28. Some initially scored only 5 detections across 62 engines. Obfuscated VBA assembled strings at runtime, performed XOR-encoded reconnaissance, and dropped a 64-bit Covenant Grunt loader disguised as a log file; the samples contacted Dropbox infrastructure. Nextron Systems
· Oct 20 · observed · via phishing email · Threat Activity
August 28, 2026
- BlueDelta ran initial-access campaigns against European diplomacy from late September 2025 to early April 2026, delivering a lightweight Windows batch-script backdoor dubbed HOOKEDGE via macro-enabled Word documents. Targets were government and diplomatic bodies in Romania, Spain and Türkiye, with lures impersonating Spain's Ministry of the Presidency (Recorded Future).
· Aug 28 · observed · via phishing email · as bluedelta · Threat Activity
Jul 25 – July 26, 2026
- Compromised hotel Wi-Fi gateways are being used to DNS-poison travelers onto fake Microsoft 365 login pages and steal MFA-satisfied OAuth tokens, active since June 2026, per CyberInsider. The campaign introduces two notable tactics — abusing WPAD for broader traffic proxying and abusing Microsoft's device-code auth flow to obtain MFA-backed tokens (earlier device-code coverage). @blackorbird notes the tradecraft is similar to APT28.
· Jul 26 · observed · via phishing email · Cloud & Identity
July 4, 2026
- APT28 covert-attack analysis. A write-up details APT28 activity leveraging Explorer hijacking, LSB steganography, and related techniques. blackorbird
· Jul 4 · demonstrated · Threat Intelligence