Russia-backed BlueDelta group attacks institutions in Romania, Spain and Turkey
Government and diplomatic organisations in Romania were targeted for seven months by the BlueDelta hacker group, linked to the Russian state. The espionage campaign affected three European states.
Russian cyber espionage campaign lasting seven months, targeting institutions in Romania
Government and diplomatic organisations in Romania fell victim to an extensive cyber espionage operation, reports Jurnalul.ro citing international specialist press. The campaign was attributed to the BlueDelta group, considered to be sponsored by the Russian state.
According to Security Affairs, the Insikt group of Recorded Future has documented this operation in detail. The attacks took place from September 2025 to April 2026 — seven consecutive months — and targeted government and diplomatic institutions in Romania, Spain and Turkey.
As primary command and control infrastructure, BlueDelta used webhook.site, a service originally created for developers for the purpose of testing HTTP requests. The choice of a legitimate tool made detection of malicious activity more difficult.
The infiltration method was based on Microsoft Word documents with macros, designed to appear authentic and to cause recipients to activate the content. Once activated, the macros allowed unauthorised access to the compromised systems.
The Insikt Group researchers estimate, with a moderate degree of confidence, that the operation belongs to BlueDelta. The report highlights that the backdoor used in this campaign, named HOOKEDGE, represents an evolved version of the previous tool HEADLACE, used by the same operators in previous campaigns.
"The code and structural design of HOOKEDGE present significant overlaps with HEADLACE, a backdoor used by BlueDelta in previous campaigns," it is stated in the Recorded Future report.
The conclusion of experts is that BlueDelta does not reinvent its arsenal, but rather continuously perfects its existing techniques — a well-documented pattern of the group.
Recorded Future warns that BlueDelta will likely continue espionage operations against European government and diplomatic organisations, particularly those involved in issues related to NATO, European governance and relations with states from the former Soviet space.
Source: Jurnalul.ro