Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
The BlueDelta group conducted initial-access campaigns from September 2025 through April 2026 against government and diplomatic organizations in Romania, Spain, and Turkey, distributing the HOOKEDGE batch-script backdoor. According to an August 27, 2026 report from Recorded Future's Insikt Group, the malware represents an evolution of the HEADLACE implant: it shares the same core architecture but introduces operational refinements to evade sandboxes and adapt to the limits of free-tier legitimate webhook APIs. The choice of non-dedicated C2 infrastructure makes detection based on malicious domains anomalous.
- HOOKEDGE is a Windows batch-script backdoor that abuses webhook.site (free tier) for command, control, staging, and exfiltration, sharing HEADLACE's core architecture.
- Campaigns targeted government and diplomatic entities in three countries — Romania, Spain, and Turkey — over a span of roughly seven months.
- A Spanish lure impersonated the Ministry of the Presidency, Justice and Relations with the Cortes, created after the September 8, 2025 meeting with Moldovan officials; the oldest document was observed on September 26, 2025.
- Persistence is achieved via a scheduled task executing every 30 minutes; a secondary payload with more frequent beaconing was deployed for higher-value intelligence targets.
From HEADLACE to HOOKEDGE: BlueDelta's Operational Evolution
Insikt Group documents that HOOKEDGE "shares HEADLACE's core architecture, abusing legitimate webhook services for command-and-control (C2), payload staging, and data exfiltration." The continuity is not merely technical: the group has maintained an established tradecraft, preferring to refine it rather than develop new capabilities from scratch. Between September 2025 and April 2026 the implant underwent "continuous refinement," likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site.
The choice of a free public webhook service as the sole C2 infrastructure represents a significant operational advantage. It eliminates the need to register malicious domains, reduces the detection surface for threat intelligence systems based on traditional indicators of compromise, and exploits the inherent legitimacy of traffic to webhook.site.
"The implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site" — Insikt Group, Recorded Future
The Infection Chain: Macro Word and Six Files in %userprofile%
The initial vector consists of Microsoft Word documents with enabled macros. A lure of particular note impersonated the Spanish Ministry of the Presidency, Justice and Relations with the Cortes, created "shortly after" the bilateral meeting with Moldovan officials on September 8, 2025. The report explicitly notes that the document's authenticity has not been verified: the lure may have been fabricated ad hoc to exploit the diplomatic context.
Once the macro is triggered, the installation chain writes six files to the %userprofile% directory: a .bat file constituting the HOOKEDGE payload, a .vbs file as launcher, a .cmd file as installer, a second .vbs file as the installer's launcher, and two staging files for exfiltration (.htm and .xhtml). The installer then deletes itself, the installer's launcher, and the task definition file, reducing superficial forensic artifacts.
Persistence is ensured by a scheduled task that executes the HOOKEDGE launcher with the payload as an argument every 30 minutes.
Diplomatic Targeting and Shift to Generic Lures
The Spanish campaign, observed from September 26, 2025, displayed a highly contextualized lure. Between October and December 2025 BlueDelta shifted to generic lures, likely to broaden targeting in Romania. In early April 2026, HOOKEDGE variants targeted organizations in Turkey, according to network telemetry data analyzed by Insikt Group.
The report highlights an operational differentiation based on the target's intelligence value: "For targets assessed as having higher intelligence value, BlueDelta deployed a second-stage HOOKEDGE payload with a much shorter beaconing interval." This suggests an internal prioritization model that allocates C2 resources based on target assessment.
Insikt Group assesses with "medium confidence" that the targeting pattern reflects "active Russian intelligence collection against European diplomatic targets, particularly those related to Moldovan political affairs and NATO-adjacent governance." The attribution to Russian intelligence interests is explicit in the report; the specific link to the threat cluster commonly known as APT28 (Fancy Bear, Strontium) is implicit in Recorded Future's "BlueDelta" branding, not stated textually in the analyzed text.
What to Do Now
Government and diplomatic organizations in the three target countries — Romania, Spain, and Turkey — should check for anomalous scheduled tasks with 30-minute intervals executing .vbs files in %userprofile%. The search must include files with .bat, .vbs, .cmd, .htm, and .xhtml extensions created near the documented campaign dates: from September 26, 2025 for the Spanish lure, between October and December 2025 for the Romanian phase, and early April 2026 for the Turkish targeting.
Security teams must extend monitoring of traffic to webhook.site beyond legitimate development contexts, analyzing requests for regular beaconing patterns or payload staging. Detection based solely on dedicated malicious domains is ineffective against this pattern: it is necessary to correlate webhook traffic with script-based process execution from user directories.
For targets with diplomatic exposure to Moldovan affairs or NATO-adjacent governance, the report suggests a priority risk assessment: BlueDelta has demonstrated the ability to differentiate beaconing based on the perceived value of the target, with more aggressive secondary payloads for objectives of higher intelligence interest.
Frequently Asked Questions
What is the difference between HOOKEDGE and HEADLACE?
HOOKEDGE shares HEADLACE's core architecture, including the abuse of webhook services for C2, but introduces modifications during the September 2025–April 2026 period to evade sandboxes and adapt to free-tier API constraints.
Why is webhook.site difficult to detect as C2?
It is a legitimate service widely used for testing and development; traffic to it does not automatically trigger alerts in security systems, unlike dedicated malicious domains.
Was the Spanish document authentic?
Insikt Group's report explicitly states that the authenticity of the lure document has not been verified. It may have been created ad hoc to exploit the context of the bilateral meeting.
Information is based on the cited source and current as of publication.
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.