Cybersecurity researchers from Recorded Future Insikt Group have identified a series of campaigns attributed to APT28 targeting government and diplomatic organizations in Romania, Spain, and Türkiye. The campaigns took place between late September 2025 and early April 2026. The threat actor deployed a previously undocumented backdoor named HOOKEDGE, described as a lightweight Windows batch script. The targeting of European government and diplomatic entities aligns with APT28's known espionage objectives. This activity represents a continued evolution in APT28's toolset with the introduction of new, custom malware. The use of a batch script-based backdoor suggests an attempt to evade detection through living-off-the-land techniques.
HOOKEDGE is a lightweight Windows batch script backdoor attributed with moderate confidence to APT28 (Fancy Bear / Forest Blizzard / BlueDelta). Active between late September 2025 and early April 2026, it targets government and diplomatic organizations in Romania, Spain, and Türkiye. It is delivered via macro-enabled Microsoft Word documents with diplomatic-themed lures that prompt victims to click 'Enable Content', triggering a macro that writes six files to the '%userprofile%' directory and launches an installer chain. The installer creates a scheduled task running every 30 minutes to execute the HOOKEDGE launcher. After installation, the installer and related files self-delete to reduce forensic footprint. Lure documents contain a hidden image referencing a webhook[.]site URL to beacon victim IP addresses upon document open (later removed to reduce network IOCs). HOOKEDGE enters a polling loop, fetching arbitrary .cmd payloads from a webhook[.]site staging endpoint, executing them, and exfiltrating results back via HTTP requests made using Microsoft Edge in headless or hidden window mode. Temporary files are deleted after each cycle, and processes matching the HOOKEDGE task identifier are terminated. High-value targets receive a second-stage HOOKEDGE payload with a beaconing interval as short as 5 minutes. The two-stage architecture separates initial-access infrastructure from active collection infrastructure to manage webhook[.]site free-tier limits (100 requests per endpoint). HOOKEDGE shares significant code and tradecraft overlap with HEADLACE, a prior APT28 backdoor used since April 2023, and is described as its direct evolutionary successor. The group has continuously refined the implant to evade sandboxes and adapt to API rate limits.
1. Block macro execution from internet-originated Office documents via Group Policy or endpoint protection controls. 2. Implement detection coverage for scheduled task abuse, particularly tasks with short intervals (every 5-30 minutes). 3. Monitor and alert on headless Microsoft Edge execution, especially when initiated by unusual parent processes. 4. Block or alert on outbound connections to webhook[.]site and similar webhook/request-bin services. 5. Monitor the '%userprofile%' directory for unexpected file writes and rapid self-deletion patterns. 6. Inspect network traffic for HTTP requests to webhook[.]site endpoints, particularly for POST requests containing command output. 7. Deploy email and web gateway filtering to detect and block macro-enabled Word documents with diplomatic or government-themed lures. 8. Enable and review scheduled task creation audit logs. 9. Consider threat intelligence sharing and hunting for HOOKEDGE and HEADLACE IOCs across organizational infrastructure.
webhook[.]site URLs used for C2, payload staging, and data exfiltration, Scheduled task running every 30 minutes executing HOOKEDGE launcher, Macro-enabled Microsoft Word documents with diplomatic-themed lures, Hidden image in lure document referencing webhook[.]site URL, Files written to %userprofile% directory during installation, Microsoft Edge launched in headless or hidden window mode for C2 communication, .cmd payloads fetched and executed from webhook[.]site staging endpoints, HTML files used to transmit exfiltrated command output to webhook URL, HOOKEDGE batch script backdoor, HEADLACE backdoor (related predecessor)
