Full Report
Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batch script that's distributed via
Analysis Summary
# Threat Actor: APT28 (BlueDelta)
## Attribution & Identity
* **Name/Alias:** APT28, BlueDelta (Recorded Future moniker), Fancy Bear, Forest Blizzard.
* **Attribution:** Russian state-sponsored hacking group (moderate confidence).
* **Associations:** Historically linked to the GRU (Russian General Staff Main Intelligence Directorate).
## Activity Summary
Between late September 2025 and early April 2026, the actor conducted cyber espionage campaigns targeting government and diplomatic entities in Europe. These operations introduced **HOOKEDGE**, a lightweight Windows batch script backdoor described as the "direct evolutionary successor" to the group’s previously used **HEADLACE** malware. The campaign transitioned from impersonating Spanish government materials to broader social engineering lures to deploy the implant.
## Tactics, Techniques & Procedures
* **Phishing & Social Engineering:** Distribution of macro-enabled Microsoft Word documents with diplomatic-themed lures.
* **Persistence:** Use of scheduled tasks (executing every 30 minutes) to maintain access via a launcher script.
* **Evasion & Anti-Forensics:** The installer deletes itself, the launcher, and task definition files after execution to reduce the forensic footprint.
* **Living off the Land (LotL):** Use of Windows batch scripts and Microsoft Edge in headless/hidden mode to facilitate network requests.
* **C2 Communication:** Abuse of legitimate services (webhook[.]site) for payload staging and data exfiltration to blend in with legitimate traffic.
* **Two-Stage Architecture:** Implementation of a secondary stage for high-value targets to bypass request limits on free-tier C2 services and separate initial access from active collection.
* **MITRE ATT&CK IDs:**
* T1566.001 (Phishing: Spearphishing Attachment)
* T1053.005 (Scheduled Task/Job: Scheduled Task)
* T1059.003 (Command and Scripting Interpreter: Windows Command Shell)
* T1102.002 (Web Service: Bidirectional Communication)
* T1070.004 (Indicator Removal: File Deletion)
## Targeting
* **Sectors:** Government, Diplomatic organizations.
* **Geography:** Romania, Spain, and Türkiye.
* **Victims:** Specifically noted were organizations associated with the Spanish government and other high-value diplomatic targets in the identified regions.
## Tools & Infrastructure
* **Malware Families:**
* **HOOKEDGE:** A previously undocumented lightweight Windows batch backdoor.
* **HEADLACE:** A modular Windows backdoor (ancestor to HOOKEDGE).
* **Infrastructure:**
* **webhook[.]site:** Used for command-and-control (C2), payload staging, and data exfiltration.
* **Microsoft Edge:** Utilized in headless mode for stealthy HTTP requests.
## Implications
The evolution from HEADLACE to HOOKEDGE demonstrates APT28’s agility in refining tools to bypass automated sandbox detection and adapt to the limitations of third-party services like webhook[.]site. By leveraging legitimate web services for C2, the actor effectively lowers the cost of operations while increasing the difficulty for defenders to distinguish malicious traffic from benign business activity. The focus on European diplomatic targets suggests a continued strategic interest in regional geopolitical intelligence.
## Mitigations
* **Macro Controls:** Disable Office macros by default or enforce "Block macros from running in Office files from the Internet" via Group Policy.
* **Service Monitoring:** Monitor network traffic for unusual or persistent connections to `webhook[.]site` and similar developer-centric tools.
* **Endpoint Analysis:** Audit the creation of new scheduled tasks, specifically those referencing `%userprofile%` and `.cmd` or `.bat` files.
* **Headless Browser Monitoring:** Implement logging to detect instances of `msedge.exe` running with `--headless` or `--window-position` flags in environments where this is not standard behavior.