APT28 Deploys HOOKEDGE: Lightweight Two-Stage Backdoor Targets European Governments

The APT28 group, also known as BlueDelta, Fancy Bear, and Forest Blizzard, has deployed the HOOKEDGE backdoor against government, diplomatic, and defense targets in Romania, Spain, and Turkey. The attribution, made with "moderate confidence," comes from Recorded Future Insikt Group and PolySwarm based on technical overlap with the previous HEADLACE backdoor. The campaign is documented from September 2025 through July 2026.

HOOKEDGE is a backdoor built on Windows batch scripts, with no complex custom malware code. It leverages macro-laden Word documents delivered via spearphishing and a command-and-control channel that abuses Microsoft Edge in headless mode and the free webhook.site infrastructure.

How the Infection Chain Works

The initial access vector is macro-enabled Microsoft Word documents delivered via spearphishing with diplomatic-themed lures. Early versions impersonated Spain's Ministry of the Presidency, Justice, and Relations with the Cortes; later variants adopted generic text urging users to "Enable Content."

Macro execution writes six files to the user's %userprofile% directory — batch, command, VBScript, HTML, and XHTML — and launches the installation chain. The malicious document simultaneously displays a fake Word error message to reduce user suspicion. Persistence is achieved through a Windows scheduled task that runs the HOOKEDGE launcher at regular intervals.

The Invisible C2: Edge Headless and the Two-Stage Architecture

The core mechanism of HOOKEDGE is the abuse of Microsoft Edge in headless or hidden-window mode to communicate with webhook.site endpoints. The traffic blends with ordinary HTTPS browsing, exploiting the domain's legitimacy to evade reputation-based network filters.

The C2 beaconing retrieves .cmd commands from a staging webhook, executes them, and sends output to a separate webhook via HTML files. Temporary files are deleted after each cycle to reduce forensic footprint. This two-stage architecture separates initial-access infrastructure from active-collection infrastructure, mitigating the free tier's 100-request-per-endpoint limit on webhook.site. With a 30-minute beacon interval, a single endpoint's quota is exhausted in roughly 2-3 days; separating webhooks allows operators to dedicate distinct endpoints to high-value victims.

Three beacon interval configurations exist: 30 minutes for the standard first stage, 61 minutes for a later variant, and 5 minutes for the second stage reserved for high-value targets. The 61-minute interval is likely designed to outlast automated sandboxes that monitor for approximately one hour.

"The implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site" — Recorded Future, via The Hacker News

Tradecraft Evolution: From HEADLACE to HOOKEDGE

Recent HOOKEDGE variants, identified in June-July 2026, show adaptations from earlier versions. BlueDelta removed the document-opening canary — a hidden image in early versions that reported to a webhook to signal opening — presumably to reduce network indicators. Operators administered webhook endpoints via NordVPN IP addresses.

Recorded Future describes HOOKEDGE as a "direct evolutionary successor to HEADLACE." The "moderate confidence" attribution rests on technical and operational overlap: batch architecture, browser-based communication, abuse of legitimate services, hidden execution, and similarly structured JavaScript payloads.

According to Recorded Future, "Rather than introducing new capabilities, the group has steadily refined its existing tradecraft, emphasizing operational resilience by adapting established tooling to evolving defensive measures and infrastructure constraints."

Analysis: Operational Lightweight as Strategy

The choice of a batch-script backdoor without complex custom malware code signals a preference for lightweight adaptability over technological sophistication. The use of legitimate services like webhook.site and Microsoft Edge reduces the need for proprietary infrastructure and its associated maintenance costs.

The two-stage architecture, with differentiated beacon intervals, suggests an approach that segments victims by operational priority. The source does not specify whether this segmentation reflects a predefined hierarchy or a dynamic post-compromise assessment.

What to Do Now

Security analysts should factor webhook service abuse into their threat models, particularly HTTPS traffic to webhook.site originating from browser processes not associated with interactive user sessions. The source does not specify preventive or detection countermeasures beyond this general observation.

The documented campaign concluded in July 2026; sources do not confirm ongoing operations at the time of publication.

Sources

• Kobaran — HOOKEDGE malware used by Russian APT28 hackers
• The Hacker News — APT28-linked HOOKEDGE backdoor targets European governments
• SecureReading — APT28 HOOKEDGE backdoor European government targets
• Cryptika — Russian hackers use new HOOKEDGE malware
• GBHackers — Russian APT28-linked hackers deploy HOOKEDGE backdoor