The Russian military intelligence-linked group APT28, also tracked as BlueDelta, has expanded its espionage operations with a new backdoor called HOOKEDGE aimed at Windows systems.
The campaign, assessed with moderate confidence, focused on government, diplomatic, and defense-sector organizations in Romania, Spain, and Turkey. Attacks occurred between September 2025 and April 2026.
Initial access relied on spear-phishing emails containing Microsoft Word documents with macros. Some files impersonated Spanish government materials and prompted victims to click “Enable Content.”
Execution of the macro writes files to the user directory, launches an installation chain, and creates a scheduled task for persistence. Several installation components are deleted afterward to hinder forensic analysis.
HOOKEDGE is a lightweight backdoor written in batch scripts. It polls external servers for commands, executes .cmd files on the compromised host, and returns results to the operators.
To evade detection, the malware routes traffic through hidden or headless instances of Microsoft Edge and the legitimate webhook.site service, making malicious communications resemble ordinary web browsing.
Against higher-value targets, operators deployed a second HOOKEDGE instance configured for five-minute check-ins, enabling faster command execution and data exfiltration.
The new implant shares significant code similarities with the older HEADLACE backdoor previously linked to the same threat actor.
