Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based command-and-control infrastructure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Diplomatic briefing document (requires Enable Content)” with an official-looking Word file attached. This is how APT28 has been hitting ministries in Romania, Spain, and Türkiye: a macro-enabled Word doc that opens, phones home via a hidden image to webhook.site, then pushes the HOOKEDGE backdoor. The trick is simple: the document impersonates Spanish government or diplomatic material and shoves a big yellow bar telling you to click “Enable Content” so you can read it. That click lets the HOOKEDGE malware in. Your move is easy: if any Office document asks you to click “Enable Content,” especially for diplomatic or government material, stop and report it to security, do not click.
Microsoft reports that the Russia-linked group Star Blizzard expanded from highly targeted spear-phishing to larger email campaigns aimed at Ukraine supporters globally. Lures included tax-audit/unpaid-fine notices and fake conference invitations, followed by a password-protected archive that…
AhnLab reports that many APT attacks targeting organizations in South Korea in July 2026 started with spear‑phishing emails that delivered malicious Windows shortcut (LNK) files disguised as legitimate documents (including resumes). When opened, the LNK runs scripts that install…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a…
Recorded Future reports a real espionage campaign attributed to Russia-linked BlueDelta/APT28 targeting European government and diplomatic organizations. Attackers used diplomatic-themed, macro-enabled Word documents (including content impersonating Spain’s Ministry of the Presidency) to trick…
Bitdefender reports a China-linked espionage campaign (“SilkParasite”) targeting government bodies in Central Asia using spearphishing emails carrying malicious Microsoft Office documents. The malware is designed to stay quiet and blend in, including using Google Drive as a communications channel…
