[hookedge]

October 21, 2026

• APT28 breached defense-sector targets in two unnamed NATO countries. Symantec’s Swallowtail cluster targeted a naval shipbuilder, military-aircraft engine manufacturer and law-enforcement agency. One July intrusion began with a malicious Word attachment, deployed HOOKEDGE, and later introduced an undocumented reflective loader that decrypted and executed code in memory. Activity ran from July 24 through at least September 24; sensitive-data theft and uninterrupted persistence were not confirmed, according to The Record. · Threat Activity

in PHP’s php2shell RCEs Break Cover

August 28, 2026

• BlueDelta ran initial-access campaigns against European diplomacy from late September 2025 to early April 2026, delivering a lightweight Windows batch-script backdoor dubbed HOOKEDGE via macro-enabled Word documents. Targets were government and diplomatic bodies in Romania, Spain and Türkiye, with lures impersonating Spain's Ministry of the Presidency (Recorded Future). · Threat Activity

in Australia Charges Two Over the TeamPCP Supply-Chain Spree