APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
Recorded Future's Insikt Group identified campaigns deploying the previously undocumented HOOKEDGE backdoor against government and diplomatic organizations in Romania, Spain and Türkiye from late September 2025 to early April 2026. The lightweight Windows batch backdoor is delivered via macro-enabled Word documents and attributed with moderate confidence to APT28 (Fancy Bear, tracked as BlueDelta), described as the evolutionary successor to HEADLACE, using webhook.site for C2, payload staging and exfiltration. HOOKEDGE fetches .cmd payloads and returns output through headless Microsoft Edge HTTP requests, maintains a 30-minute scheduled task, and a second-stage implant gives high-value targets five-minute beaconing for interactive operator tasking.
- HOOKEDGE blends into traffic using webhook.site free-tier endpoints for C2, staging, and exfiltration.
- Macro-enabled diplomatic-themed Word documents trigger a six-file installer chain and a 30-minute scheduled task.
- Significant code and tradecraft overlap with HEADLACE supports moderate-confidence APT28 attribution.
- Second-stage implant separates high-value victims onto dedicated endpoints with beaconing as low as five minutes.
- Defenders urged to block macros from internet-originated files and detect headless Edge and webhook connections.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1053.005 Scheduled TaskT1102.001 Dead Drop ResolverT1102.002 Exfiltration to Web Service
- Vendors
- Recorded Future
- Threat actors
- APT28Fancy BearForest BlizzardBlueDelta
- Organizations
- Recorded Future
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.