APT28 Linked HOOKEDGE Backdoor Targets European Governments
A new backdoor, HOOKEDGE, linked to the APT28 threat group, has been deployed against European government and diplomatic organizations, utilizing batch scripts and webhook services for command and control.
Cybersecurity researchers have uncovered a series of campaigns targeting government and diplomatic entities in Romania, Spain, and Türkiye between September 2025 and April 2026. These attacks led to the deployment of a previously undocumented backdoor, named HOOKEDGE, which is a lightweight Windows batch script. The initial vector for these attacks involved macro-enabled Microsoft Word documents, with early versions impersonating Spanish government materials before shifting to a more general social engineering approach.
The threat activity has been attributed with moderate confidence to the Russian state-sponsored hacking group APT28, also known by aliases such as Fancy Bear and Forest Blizzard. The Mastercard-owned cybersecurity firm Recorded Future tracks this specific operation under the moniker BlueDelta. This attribution is bolstered by significant overlaps in code and operational tradecraft observed between HOOKEDGE and HEADLACE, another modular Windows backdoor previously utilized by APT28 against diplomatic targets since April 2023.
A key technical aspect of HOOKEDGE's operation is its reliance on webhook[.]site services for command-and-control (C2) communications, payload staging, and data exfiltration. This method allows malicious network traffic to blend in with legitimate activity, reducing the need for dedicated C2 infrastructure. The implant has undergone continuous refinement during the observed campaign period, likely to evade automated sandbox environments and adapt to the limitations of free-tier API usage on webhook[.]site, indicating a direct evolutionary path from HEADLACE.
The infection chain begins with a macro-enabled Word document. Upon opening and enabling content, the macro writes six files to the user's profile directory and initiates the HOOKEDGE installer. This installer creates a scheduled task to run the HOOKEDGE launcher every 30 minutes, which then executes the backdoor. To cover its tracks, the installer and related files are self-deleted, complicating incident response efforts. A hidden image within the lure document also contains a webhook[.]site URL, alerting attackers as soon as the document is opened.
Once active, HOOKEDGE functions as a basic Windows batch backdoor. It enters a polling loop, fetching arbitrary command payloads (.cmd files) from a staging webhook, executing them, and exfiltrating the results back to the webhook URL via an HTML file. This process is facilitated by launching a Microsoft Edge instance in a headless or hidden window to make the HTTP requests. Temporary files are deleted, and any process matching the HOOKEDGE task identifier is terminated to further obscure activity.
For high-value targets, BlueDelta has deployed a second-stage HOOKEDGE payload with a significantly reduced beaconing interval, as low as five minutes. This two-stage architecture helps circumvent the 100-request limit per unique endpoint imposed by webhook[.]site's free tier. By separating initial-access infrastructure from active collection infrastructure, the group ensures that ongoing operations do not exhaust the limited request quotas of the initial-access webhooks. This suggests a strategy of broad initial access followed by escalated collection against identified targets of higher intelligence value.
BlueDelta has demonstrated a consistent effort to refine its operational methods, even removing the document-open canary that previously captured victim IP addresses. While the motivation for this change is not explicitly stated, it is suspected to be an attempt to reduce network-based indicators of compromise. To mitigate this threat, organizations are advised to block macros from internet-originated documents, implement detection for scheduled task abuse, headless Microsoft Edge execution, and monitor outbound connections to webhook services. The group's continued focus on lightweight, adaptable tooling underscores its commitment to intelligence gathering against European government and diplomatic targets.