APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Recorded Future's Insikt Group observed a campaign attributed with moderate confidence to APT28 (tracked as BlueDelta) targeting government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and April 2026. The attackers deployed a previously undocumented Windows batch backdoor called HOOKEDGE via macro-enabled Word documents that write files, create scheduled tasks, and fetch/execute .cmd payloads from webhook.site endpoints; operators used a two-stage architecture and webhook.site endpoints to manage C2 and conserve free-tier quotas. The report highlights code and tradecraft overlap with the earlier HEADLACE backdoor, describes iterative refinements to evade detection, and recommends blocking macros from internet-originated documents and monitoring for scheduled task abuse, headless Edge execution, and outbound connections to webhook services.