Cybersecurity researchers have uncovered a new campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye, with activity observed between late September 2025 and early April 2026.
The campaigns have deployed a previously undocumented Windows backdoor called HOOKEDGE, according to cybersecurity and threat intelligence firm Recorded Future’s Insikt Group.
Researchers attribute the activity with moderate confidence to APT28, the Russian state-sponsored hacking group also known as Fancy Bear and Forest Blizzard. Recorded Future tracks the activity under the name BlueDelta.
The campaign is notable for its use of lightweight malware, Microsoft Word documents with diplomatic-themed lures and legitimate webhook services for command-and-control (C2), payload delivery and data exfiltration.
HOOKEDGE Linked to APT28’s HEADLACE Backdoor
Recorded Future researchers identified significant similarities between HOOKEDGE and HEADLACE, a modular Windows backdoor previously associated with APT28 operations targeting diplomatic organizations since at least April 2023.
The similarities reportedly include both code structure and operational techniques.
Both malware families have been observed abusing webhook.site infrastructure for command-and-control communications, payload staging and data theft.
Using webhook services allows attackers to avoid maintaining dedicated command infrastructure and can make malicious network traffic harder to distinguish from legitimate web activity.
Recorded Future described HOOKEDGE as a “direct evolutionary successor to HEADLACE,” noting that the malware was repeatedly modified between September 2025 and April 2026.
The changes appear to have been designed partly to evade automated sandbox analysis and adapt to limitations imposed on webhook.site’s free API service.
Attack Begins With a Malicious Word Document
The primary delivery mechanism is a macro-enabled Microsoft Word document containing diplomatic-themed content designed to convince victims to open the file.
When the document is opened, victims are prompted to click “Enable Content.”
Enabling the content activates the malicious macro, which writes six files to the user’s %userprofile% directory and begins the HOOKEDGE installation process.
The initial installer creates a scheduled task configured to execute the HOOKEDGE launcher every 30 minutes.
After completing its role, the installer deletes itself, along with the launcher and task-definition file.
This cleanup behavior is designed to reduce the number of artifacts left on the system and make forensic investigations more difficult.
Hidden Webhook Tracks Document Opens
The malicious Word document also contains a hidden image that references a webhook.site URL.
According to Recorded Future, the request allows the attackers to receive a notification when the document is opened by a victim.
Earlier versions of the campaign reportedly used this mechanism to capture the victim’s IP address.
Researchers later observed the attackers removing the document-open canary, although the exact reason for the change remains unclear.
Recorded Future believes the modification may have been intended to reduce network indicators that could help defenders identify the attack.
How the HOOKEDGE Backdoor Works
HOOKEDGE is relatively simple compared with many full-featured malware families. It is primarily implemented as a Windows batch-script backdoor that repeatedly checks a remote webhook for instructions.
The backdoor operates through a polling loop that:
- Retrieves arbitrary
.cmdpayloads from a staging webhook. - Executes the received commands on the compromised machine.
- Collects the command output.
- Sends the results back to the attackers through a webhook URL.
- Deletes temporary files after transmitting the data.
- Terminates processes associated with the HOOKEDGE task.
For network communications, the malware launches Microsoft Edge in headless mode or with its window hidden.
It then uses the browser to make HTTP requests to the webhook infrastructure.
The use of a legitimate web service for these communications can help attackers blend malicious traffic into normal outbound web activity.
A Second-Stage Payload Targets High-Value Victims
Recorded Future also identified a second-stage version of HOOKEDGE deployed against targets considered particularly valuable.
This version can reportedly beacon as frequently as every five minutes, giving operators much more control over remote tasking and post-compromise activity.
Researchers believe the two-stage approach is partly intended to overcome limitations associated with webhook.site’s free service.
The service reportedly limits each unique endpoint to 100 requests. At a 30-minute beacon interval, an endpoint could therefore reach its request limit within approximately two to three days.
By moving high-priority targets to separate second-stage webhook endpoints, the attackers can keep initial-access infrastructure separate from infrastructure used for ongoing collection and operator commands.
This helps prevent the request limits associated with initial-access endpoints from disrupting longer-term operations.
Attackers Appear to Prioritize Intelligence Collection
Recorded Future believes the campaign’s structure reflects a deliberate victim-selection process.
The first-stage implant appears to provide broad initial access, while information collected during that stage may help the attackers identify victims with greater intelligence value.
Those high-value targets can then be moved to a second-stage payload with more frequent beaconing and greater operator control.
This approach allows the attackers to focus additional resources on selected victims instead of maintaining intensive communications with every compromised system.
APT28 Continues to Adapt Its Tradecraft
Researchers observed several changes to the campaign over time, suggesting that BlueDelta is actively refining its techniques.
The group has modified HOOKEDGE to adapt to infrastructure limitations and defensive technologies while maintaining a relatively simple malware architecture.
Rather than introducing a completely new malware platform, the attackers appear to be evolving techniques already associated with APT28.
The removal of the document-open canary is one example of this adaptation. Eliminating the mechanism that collected victim IP addresses may reduce the number of detectable network indicators generated during the initial infection stage.
How Organizations Can Defend Against HOOKEDGE
Organizations in government, diplomatic and other high-value sectors should take steps to detect and block the techniques associated with this campaign.
Recommended defensive measures include:
- Block macros from internet-originated Microsoft Office documents wherever possible.
- Monitor for suspicious creation and execution of scheduled tasks.
- Detect unusual instances of Microsoft Edge running in headless or hidden mode.
- Monitor outbound connections to webhook and similar cloud-based services.
- Investigate unexpected
.cmdfiles and batch-script execution. - Use endpoint detection tools to identify suspicious parent-child process relationships.
- Apply strong email filtering to documents using diplomatic or government-themed lures.
- Educate employees about documents that unexpectedly request “Enable Content.”
Network defenders should also consider monitoring legitimate cloud and webhook services rather than automatically treating them as trusted destinations.
A Lightweight Backdoor With a Flexible Delivery Model
The emergence of HOOKEDGE demonstrates how state-sponsored threat actors can achieve effective intelligence collection without relying on sophisticated or resource-intensive malware.
By combining malicious Word documents, scheduled tasks, Windows batch scripts and legitimate webhook infrastructure, BlueDelta can establish a relatively lightweight foothold while reducing its dependence on dedicated attacker-controlled servers.
Recorded Future concluded that APT28 continues to refine its existing tradecraft rather than simply developing entirely new capabilities.
The campaign highlights the importance of detecting behavior and attack techniques, not just known malware signatures, particularly when legitimate online services are being abused for command-and-control and data theft.
Organizations handling sensitive government, diplomatic or strategic information should therefore pay close attention to macro-enabled documents, scheduled-task creation, unusual browser execution and outbound connections to webhook services.
