Cybersecurity researchers have uncovered a series of campaigns targeting governmental and diplomatic organizations across Romania, Spain, and Türkiye. These attacks, occurring between late September 2025 and early April 2026, have led to the deployment of a previously undocumented backdoor known as **HOOKEDGE**. According to **Recorded Future Insikt Group**, **HOOKEDGE** is a lightweight Windows batch script delivered via macro-enabled **Microsoft Word** documents. These documents utilize diplomatic-themed lures, initially impersonating Spanish government material before shifting to a broader social engineering approach. ### Attribution to APT28 The activity has been attributed with moderate confidence to **APT28**, a Russian state-sponsored hacking group also known as **Fancy Bear** and **Forest Blizzard**. **Recorded Future**, which tracks the group under the moniker **BlueDelta**, based this determination on significant code and tradecraft overlaps between **HOOKEDGE** and **HEADLACE**, another modular Windows backdoor previously used by **APT28** in attacks against diplomats since April 2023. Key similarities include core architectural design and the abuse of `webhook[.]site` services for command-and-control (C2), payload staging, and data exfiltration. This strategy allows malicious activity to blend seamlessly with regular network traffic, negating the need for dedicated infrastructure. ### Evolution of the Threat **Recorded Future** stated in a recent analysis that **HOOKEDGE** has undergone continuous refinement between September 2025 and April 2026. This evolution is likely aimed at evading automated sandbox environments and adapting to reduced free-tier API limits on `webhook[.]site`, describing it as a "direct evolutionary successor to **HEADLACE**."  ### Delivery and Execution Chain The primary delivery mechanism for **HOOKEDGE** is a macro-enabled **Microsoft Word** document. When opened, it prompts the victim to "Enable Content," triggering a macro that writes six files to the `%userprofile%` directory and launches the **HOOKEDGE** installer chain. The process begins with an installer launcher creating a scheduled task that executes every 30 minutes, running the **HOOKEDGE** launcher with the backdoor as an argument. The main installer then meticulously deletes itself, the installer launcher, and the task definition file to obscure traces of the malicious activity, reduce forensic footprint, and complicate incident response efforts. ### Stealthy Command and Control The lure document also embeds a hidden image referencing a `webhook[.]site` URL, alerting operators as soon as the document is opened. **HOOKEDGE** itself is a basic Windows batch backdoor that operates in a polling loop, fetching arbitrary `.cmd` payloads from a staging webhook, executing them, and transmitting the output back to the webhook URL via an HTML file. Command retrieval and data exfiltration are achieved by launching a **Microsoft Edge** instance in headless mode or a hidden window, making an HTTP request to the webhook. Upon data transmission, all temporary files are deleted, and any process with a window title matching the **HOOKEDGE** task identifier is terminated. ### Two-Stage Architecture for High-Value Targets **BlueDelta** has also been observed deploying a second-stage **HOOKEDGE** payload against high-value targets. This payload features a beaconing interval as short as five minutes, granting threat actors enhanced operational control over tasking and interactive post-compromise activities. This two-stage architecture helps mitigate infrastructure constraints, as `webhook[.]site`'s free tier imposes a maximum of 100 requests per unique endpoint. A 30-minute beaconing interval would exhaust an endpoint's allocation within two to three days. By shifting high-priority victims to dedicated second-stage webhook endpoints, **BlueDelta** effectively separates initial-access infrastructure from active collection infrastructure, preserving limited request quotas. This approach is believed to be a deliberate choice by the attackers. The first-stage implant focuses on broad initial access, with information gathered from this phase used to identify and escalate collection against victims deemed to have higher intelligence value. ### Evolving Evasion Techniques **BlueDelta** continuously refines its modus operandi to suit operational requirements. Notably, the group removed the document-open canary that captured victim IP addresses when a document was opened. While the exact motivation is unclear, it is suspected to be an attempt to reduce network-based indicators of compromise. ### Recommendations for Defense To counter this evolving threat, organizations are strongly advised to: * Prioritize blocking macro execution from internet-originated documents. * Implement robust detection coverage for scheduled task abuse. * Monitor for headless **Microsoft Edge** execution. * Scrutinize outbound connections to webhook services. **Recorded Future** concludes that **BlueDelta** continues to invest in lightweight, adaptable initial-access tooling to support intelligence collection against European government and diplomatic targets. The group emphasizes operational resilience by steadily refining existing tradecraft to adapt to evolving defensive measures and infrastructure constraints, rather than introducing entirely new capabilities.