Russian APT28-Linked Hackers Deploy HOOKEDGE Backdoor in European Espionage Attacks

Russian state-linked threat actor BlueDelta, also tracked as APT28, Fancy Bear, and Forest Blizzard, has used a lightweight Windows backdoor named HOOKEDGE in cyberespionage operations against European diplomatic, government, and defense-sector organizations.

Researchers linked the activity to targets in Romania, Spain, and Turkey, with campaign activity observed from late September 2025 through early April 2026 and newer variants emerging during June and July 2026.

According to Polyswarm, BlueDelta delivered HOOKEDGE through spearphishing attachments containing macro-enabled Microsoft Word documents.

Russian APT28-Linked Hackers Deploy HOOKEDGE Backdoor

Early lures used diplomatic themes, including a file impersonating material from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes.

Later campaigns shifted to generic documents containing junk text or prompts that asked recipients to select “Enable Content.” When a victim enables macros, the document displays a fake Microsoft Word error message while its AutoOpen() routine begins a multi-stage infection process in the background.

The macro writes batch, command, VBScript, HTML, and XHTML files into the user profile directory. These components ensure persistence via a Windows Scheduled Task that launches the HOOKEDGE payload at configured intervals.

Installation scripts subsequently remove themselves and associated artifacts, limiting evidence available to incident responders. HOOKEDGE operates as a polling backdoor, relying on Microsoft Edge rather than on a dedicated malware networking component.

During each execution cycle, the backdoor clears download artifacts, launches msedge.exe, and contacts attacker-controlled endpoints created through webhook[.]site.

The malware retrieves staged content, combines it into a .cmd payload, executes the command, captures its output, and embeds the results in an HTML file.

A second Edge instance then submits that data to a separate webhook endpoint via an HTTP POST request before deleting the temporary files.

Using Microsoft Edge and a legitimate webhook platform helps the operation blend into ordinary HTTPS browser traffic. Earlier versions ran Edge in headless mode, while later variants used hidden browser windows.

BlueDelta also reportedly administered observed webhook endpoints through NordVPN IP addresses, adding another layer of operational concealment.

Polyswarm found that BlueDelta used HOOKEDGE to selectively intensify surveillance of compromised organizations. A first-stage implant could beacon every 30 minutes, while secondary HOOKEDGE instances deployed against higher-value victims communicated as frequently as every five minutes.

This tiered approach likely allows operators to identify successful and strategically important compromises before committing additional infrastructure and operational effort. It also helps avoid webhook[.]site free-tier request limits, which cap the number of requests at 100.

A later first-stage variant used a 61-minute beacon interval. The timing may reduce endpoint consumption while potentially bypassing automated sandbox systems that typically monitor suspicious programs for about 1 hour.

HOOKEDGE shares substantial code and operational overlap with BlueDelta’s previously documented HEADLACE backdoor. Both use Windows batch scripting, browser-mediated command-and-control, legitimate internet services, hidden execution, and lightweight payload-delivery mechanisms.

Recorded Future assessed with moderate confidence that HOOKEDGE is a direct evolution of HEADLACE and that BlueDelta conducted the campaign.

The targeting pattern focused on European government, diplomatic, and defense-related entities aligns with longstanding Russian intelligence-collection priorities.

The activity shows how state-backed operators can achieve persistent espionage access without deploying technically complex malware.

Defenders should monitor macro-enabled attachments, suspicious scheduled tasks, unusual Edge child processes, browser-launched command scripts, and connections to newly created webhook services.

IOCs

Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN