APT28's HOOKEDGE Backdoor Refines Espionage Tactics

European government and diplomatic organizations in Romania, Spain, and Türkiye have been targeted in a series of campaigns between late September 2025 and early April 2026, according to new research from Recorded Future Insikt Group. The attacks have deployed a previously undocumented Windows backdoor named HOOKEDGE, distributed via macro-laced Word documents with diplomatic lures. Researchers attribute the activity with moderate confidence to APT28, a Russian state-sponsored hacking group also known as Fancy Bear and Forest Blizzard.

From HEADLACE to HOOKEDGE

HOOKEDGE is described as a "direct evolutionary successor" to HEADLACE, a modular Windows backdoor that APT28 has used against diplomats since April 2023. Recorded Future's analysis, published Thursday, highlights significant code and tradecraft overlap between the two implants, including core architecture similarities and the abuse of webhook[.]site services for command-and-control (C2), payload staging, and data exfiltration. This approach lets malicious activity blend with regular network traffic, avoiding the need for dedicated infrastructure.

Early versions of HOOKEDGE are said to have impersonated Spanish government material before shifting to a social engineering approach about a month later. The implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site, Recorded Future said.

Macro Lure and Installation Chain

The primary delivery vehicle is a macro-enabled Microsoft Word document that prompts the target to click "Enable Content" to view the contents. This action triggers a macro that writes six files to the "%userprofile%" directory and launches the HOOKEDGE installer chain. The installer creates a scheduled task that runs every 30 minutes to execute the HOOKEDGE launcher with the backdoor as its argument. The main installer then deletes itself, along with the installer launcher and the task definition file, to cover up traces of the malicious activity and complicate incident response.

The document also embeds a hidden image that references a webhook[.]site URL, alerting the operators as soon as the document is opened by the victim. This initial beacon provides early awareness of successful infection.

Batch Backdoor with Webhook C2

HOOKEDGE itself is a basic Windows batch backdoor that enters a polling loop, fetching arbitrary .cmd payloads from a staging webhook, executing them, and sending the output back to the webhook URL using an HTML file. Command retrieval and data exfiltration occur by launching a Microsoft Edge instance in headless mode or in a hidden window, making HTTP requests to the webhook. Once data is transmitted, all temporary files are deleted, and any process with a window title matching the HOOKEDGE task identifier is terminated.

Two-Stage Architecture for High-Value Targets

BlueDelta has also deployed a second-stage HOOKEDGE payload against high-value targets with a beaconing interval as little as five minutes, giving attackers more operational control over tasking and interactive post-compromise activity. This two-stage architecture helps mitigate infrastructure constraints: webhook[.]site's free tier imposes a maximum of 100 requests per unique endpoint, meaning a 30-minute beaconing interval would exhaust a given endpoint's request allocation within approximately two to three days. By moving high-priority victims to dedicated second-stage endpoints, BlueDelta separates initial-access infrastructure from active collection infrastructure, ensuring that ongoing tasking does not exhaust the request quotas of the initial-access endpoints.

"The two-stage architecture also helps to mitigate one of BlueDelta's infrastructure constraints. webhook[.]site's free tier imposes a maximum of 100 requests per unique endpoint, meaning a 30-minute beaconing interval would exhaust a given endpoint's request allocation within approximately two to three days."

— Recorded Future Insikt Group

Adapting to Defenses

BlueDelta has continually tweaked its modus operandi to suit operational requirements, even removing the document-open canary that captured victim IP addresses when the document was opened. While the motivation is unclear, it is suspected to be an attempt to reduce network-based indicators of compromise.

Recommendations and Implications

To counter the threat, organizations are recommended to block macro execution from internet-originated documents, and implement detection coverage for scheduled task abuse, headless Microsoft Edge execution, and outbound connections to webhook services. The findings underscore the persistent focus of APT28 on European diplomatic targets and the group's willingness to refine lightweight tooling to evade defenses.

The continuous evolution of HOOKEDGE suggests that APT28 is prioritizing stealth and adaptability over new capabilities, which could make detection increasingly challenging for defenders. As these tools become more evasive, organizations in government and diplomatic sectors must remain vigilant against evolving phishing lures and maintain robust monitoring for anomalous webhook usage.