APT28 HOOKEDGE Backdoor Abuses Microsoft Edge and webhook.site for C2 and Data Exfiltration

Russian state-linked threat actor BlueDelta, also known as APT28, Fancy Bear, and Forest Blizzard, has launched phishing campaigns using a lightweight Windows backdoor called HOOKEDGE.

The activity targeted government, diplomatic, and defense manufacturing organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026.

Insikt Group assessed with moderate confidence that BlueDelta conducted the activity.

The assessment is based on code, infrastructure, and operational similarities between HOOKEDGE and HEADLACE, a batch-script backdoor previously linked to the group. BlueDelta is widely associated with Russia’s GRU military intelligence service.

The campaign begins with macro-enabled Microsoft Word documents, likely delivered through spearphishing emails.

Early samples used diplomatic-themed lures impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes. Later documents used generic messages that instructed recipients to click “Enable Content.”

Once macros are enabled, the malicious document drops several files into the victim’s user profile directory and starts an installer chain.

The installer creates a scheduled task to maintain persistence, then deletes itself and related installation files to reduce evidence on the compromised system.

APT28 HOOKEDGE Exploits Edge Webhooks

HOOKEDGE is a Windows batch-script backdoor designed to retrieve commands, execute them, and send the results to the attackers.

Rather than using attacker-controlled servers, it abuses the legitimate webhook.site platform for command-and-control, payload hosting, and data exfiltration.

The malware uses Microsoft Edge for both command retrieval and data theft. On each scheduled execution, Edge contacts a webhook.site URL that delivers a payload.

The payload is downloaded as one or more files, combined into a Windows command script, and executed on the infected machine.

HOOKEDGE then captures the command output and places it within an HTML file. A second hidden Edge process opens that file, triggering an automatic HTTP POST request that sends the collected data to a separate webhook.site endpoint controlled by the operators.

This technique helps malicious traffic resemble normal browser activity. It also avoids reliance on a custom malware network client or commonly abused Windows utilities.

BlueDelta further used separate webhook endpoints for document-open and email-open tracking, allowing operators to monitor whether phishing messages and attachments were opened.

For selected high-value victims, the group deployed a second HOOKEDGE payload with a faster beaconing interval. While the first-stage implant contacted its C2 every 30 minutes or longer, second-stage variants could run as often as every five minutes.

This gave operators faster access to victim systems while preserving the limited request quota of the free webhook.site service, recordedfuture said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN