> ## Content Index > Fetch the complete content index at: https://www.adriadefense.com/llms.txt > Use this file to discover other available public pages before exploring further. # Europe Intelligence Update: Chinese Spy Case and Russian Cyberattacks - URL: https://www.adriadefense.com/europe-intelligence-update-chinese-spy-case-and-russian-cyberattacks/ - Published: 2026-09-08T05:30:38.000Z - Updated: 2026-09-08T05:30:37.000Z - Description: Belgium is investigating suspected Chinese semiconductor espionage as researchers detail a Russian-linked cyber campaign targeting European institutions. - Author: AdriaDefense Desk - Tags: Intelligence, Russia, China, Industry, Espionage, Cybersecurity, Belgium Europe is confronting two distinct intelligence threats involving strategically sensitive technology and government networks. Belgian prosecutors are investigating a Chinese-Belgian former semiconductor executive over the suspected transfer of sensitive gallium nitride technology to China, while cybersecurity researchers have detailed a Russian-linked campaign targeting government, diplomatic and defense organizations in Romania, Spain and Türkiye. The two cases are unrelated, and there is no indication of coordination between China and Russia. Together, however, they illustrate different intelligence collection methods confronting European states: suspected human-enabled industrial espionage targeting dual-use technology and remote cyber operations aimed at government and defense-related networks. ## Belgium investigates suspected semiconductor espionage Belgian authorities have detained a **52-year-old dual Chinese-Belgian national** as part of an investigation into suspected espionage involving semiconductor technology. The suspect previously held a senior position at BelGaN, a Belgian semiconductor manufacturer that specialized in gallium nitride technology before entering bankruptcy. According to Belgian prosecutors cited by Reuters, investigators suspect the man transferred sensitive intellectual property and trade secrets from BelGaN to a Chinese semiconductor company. Authorities also suspect that he simultaneously served as a director of the Chinese company, which was established after he joined BelGaN and received funding from a Chinese investment group. Belgian authorities arrested the suspect at **Brussels Airport in Zaventem** while he was preparing to travel to Beijing. He has remained in detention since May, while another individual linked to the investigation remains at large. The allegations remain under investigation. The detention does not establish that the suspected technology transfer occurred, and the case has not produced a final judicial finding. ## Gallium nitride technology has defense and aerospace applications The technology at the center of the Belgian investigation gives the case significance beyond commercial semiconductor competition. BelGaN specialized in **gallium nitride, or GaN, semiconductor technology**, which has applications in electric vehicles as well as aerospace and military systems. GaN technology is particularly relevant to defense electronics because of its ability to operate efficiently at high frequencies and power levels. Those characteristics make the semiconductor material useful across applications that can include radar, electronic warfare, communications and other radio-frequency systems. The investigation therefore sits at the intersection of industrial security and national security. European governments have increasingly treated advanced semiconductor manufacturing, intellectual property and other dual-use technologies as strategic assets. The Belgian case illustrates how protecting that industrial base also requires counterintelligence measures focused on personnel, corporate relationships and technology transfers. The precise technology allegedly transferred from BelGaN has not been publicly detailed. It would therefore be premature to conclude that specific military designs or defense programs were compromised. ## Russian-linked HOOKEDGE campaign targeted European organizations Europe is simultaneously dealing with a different intelligence collection problem in cyberspace. Recorded Future's Insikt Group disclosed in late August that it had identified a series of cyber campaigns targeting organizations in **Romania, Spain and Türkiye** between late September 2025 and early April 2026\. The targets included government, diplomatic and defense manufacturing organizations. Researchers attributed the activity with moderate confidence to BlueDelta, which overlaps with the threat actor commonly tracked as APT28, Fancy Bear and Forest Blizzard. APT28 has been attributed to Russia's Main Directorate of the General Staff of the Armed Forces of the Russian Federation, or GRU. The attribution should not be treated as a direct government confirmation. It represents the technical assessment of Recorded Future based on similarities in code, infrastructure, targeting and operational methods. The researchers identified a previously undocumented lightweight Windows backdoor named **HOOKEDGE** as part of the campaigns. ## HOOKEDGE uses Word documents and legitimate web services The operation relied on macro-enabled Microsoft Word documents to establish initial access. Early campaign material used diplomatic themes, including a document impersonating material from Spain's Ministry of the Presidency, Justice and Relations with the Cortes. Researchers observed that lure shortly after a September 2025 meeting between Spanish and Moldovan officials. Later campaigns moved toward more generic social-engineering documents instructing recipients to enable content. Researchers assessed that the shift may have accompanied broader targeting, including institutions in Romania. HOOKEDGE itself is a lightweight batch-script backdoor. Once deployed, it can retrieve commands, execute them on the compromised Windows system and return results to the operator. One of the more notable elements is the use of legitimate internet infrastructure. BlueDelta used the legitimate developer service webhook.site for command and control, staging and data exfiltration. HOOKEDGE also used Microsoft Edge to communicate with those endpoints, allowing malicious activity to operate through services and software that may also generate legitimate network traffic. For targets assessed as having greater intelligence value, researchers identified second-stage HOOKEDGE configurations with more frequent communication intervals. That could provide operators with more responsive control after obtaining access. ## Romania puts the cyber campaign inside NATO's eastern flank The targeting of Romanian organizations makes the HOOKEDGE findings particularly relevant for Central and Eastern European security. Romania is a NATO member on the alliance's eastern flank, borders Ukraine and hosts allied military infrastructure. Its government, diplomatic and defense institutions therefore hold information potentially relevant to Russian intelligence priorities. Recorded Future assessed that the overall targeting pattern was consistent with Russian intelligence collection against European diplomatic targets, including organizations connected to Moldovan political affairs and wider NATO-adjacent European governance. Researchers did not publish a complete list of affected organizations, and targeting should not be interpreted as confirmation that every targeted institution was successfully compromised. That distinction is important in assessing cyber intelligence reporting. Evidence that an attacker attempted to obtain access does not necessarily demonstrate that sensitive data was ultimately stolen. ## China and Russia present different intelligence challenges for Europe The Belgian investigation and HOOKEDGE campaign demonstrate two different routes through which sensitive European information can become an intelligence target. The Belgian case centers on allegations involving a person with access to commercially sensitive semiconductor technology. If prosecutors substantiate those allegations, the case would represent an insider-enabled pathway for acquiring strategically valuable industrial knowledge. The Russian-linked operation shows the remote alternative. Rather than placing an individual inside a technology company, the HOOKEDGE campaign used malicious documents, social engineering and legitimate internet services to target government, diplomatic and defense-related organizations across multiple countries. Both approaches place pressure on Europe's ability to protect information that sits outside traditional classified government networks. Defense manufacturing data, semiconductor intellectual property, diplomatic correspondence and supply-chain information can all carry intelligence value even when individual documents are not formally classified. For European defense companies, that expands the security problem beyond conventional perimeter protection. Personnel security, intellectual-property controls, supply-chain screening and cyber threat monitoring increasingly form parts of the same counterintelligence environment. --- ## European intelligence security questions and answers ### What is Belgium investigating in the semiconductor espionage case? Belgian prosecutors are investigating a 52-year-old Chinese-Belgian former semiconductor executive over allegations that sensitive intellectual property and trade secrets from BelGaN were transferred to a Chinese semiconductor company. The allegations remain under investigation. ### Why is gallium nitride technology important to defense? Gallium nitride semiconductors can operate efficiently at high power and frequencies, making the technology relevant to applications including radar, communications and electronic warfare. BelGaN's technology had aerospace and military applications in addition to commercial uses. ### What is the HOOKEDGE backdoor? HOOKEDGE is a lightweight Windows batch-script backdoor identified by Recorded Future's Insikt Group. Researchers observed it in campaigns against government, diplomatic and defense manufacturing organizations in Romania, Spain and Türkiye. ### Is HOOKEDGE linked to Russian intelligence? Recorded Future assesses with moderate confidence that BlueDelta conducted the campaigns. BlueDelta overlaps with APT28, Fancy Bear and Forest Blizzard, a threat cluster attributed to Russia's GRU military intelligence service.