APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

1. Executive summary

Recorded Future's Insikt Group has published details of a campaign active from late September 2025 to early April 2026 targeting government and diplomatic organisations in Romania, Spain, and Türkiye with a previously undocumented backdoor dubbed HOOKEDGE. The activity is attributed with moderate confidence to APT28 (MITRE G0007, aka Fancy Bear/Forest Blizzard, tracked by Recorded Future as BlueDelta), based on significant code and tradecraft overlap with the previously documented HEADLACE backdoor. HOOKEDGE is a lightweight Windows batch script delivered via macro-enabled Word documents using diplomatic-themed lures; it abuses webhook[.]site for C2, payload staging, and exfiltration, blending malicious traffic with legitimate web requests. EMEA financial services clients are unlikely to be primary targets but should treat this as a model for the same tradecraft being repurposed against their own diplomatic-facing, government-liaison, or public-affairs functions.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign targets government and diplomatic organisations rather than financial entities' ICT systems, and no fact in this item triggers a distinctive obligation under the listed articles that would change what a client must do. Generic incident-management or supply-chain mappings that would fit any security advisory are excluded as compliance-checkbox padding.

3. Technical analysis & attack chain

Attribution note: APT28 is confirmed as MITRE G0007 in the verified reference data. Recorded Future assesses attribution with moderate confidence based on code and tradecraft overlap with HEADLACE; this is a single-sourced attribution (one vendor report) — verify before enforcement.

Attack chain (confirmed steps)

1. Initial access — spearphishing with macro-enabled Word document. The target receives a macro-enabled Microsoft Word document bearing a diplomatic-themed lure. Early versions impersonated Spanish government material; a month later the lures shifted to a broader social engineering approach.
2. Execution — macro payload drop. When the victim clicks "Enable Content," the macro writes six files to the %userprofile% directory and launches the HOOKEDGE installer chain.
3. Persistence — scheduled task. An installer launcher creates a Windows scheduled task that runs every 30 minutes, executing the HOOKEDGE launcher with the backdoor as its argument.
4. Anti-forensics — self-deletion. The main installer deletes itself, the installer launcher, and the task definition file from the directory to reduce forensic footprint and complicate incident response.
5. Callback on document open — hidden image beacon. The lure document embeds a hidden image referencing a webhook[.]site URL, alerting operators the moment the document is opened by the victim — before any macro execution.
6. C2 and command execution — polling loop. HOOKEDGE enters a polling loop, fetching arbitrary .cmd payloads from a staging webhook endpoint, executing them, and sending the resulting output back to the webhook URL using an HTML file.
7. C2 transport — headless Microsoft Edge. Command retrieval and data exfiltration are performed by launching a Microsoft Edge instance in headless mode or in a hidden window, making HTTP requests to the webhook[.]site endpoint.
8. Post-execution cleanup. After data transmission, all temporary files are deleted, and any process whose window title matches the HOOKEDGE task identifier is terminated.
9. Second-stage escalation against high-value targets. A second-stage HOOKEDGE payload is deployed against high-value targets with a beaconing interval as short as five minutes, giving operators more interactive post-compromise control. This two-stage architecture also mitigates webhook[.]site's free-tier limit of 100 requests per unique endpoint — a 30-minute interval would exhaust a given endpoint in approximately two to three days. By moving high-priority victims to dedicated second-stage webhook endpoints, BlueDelta separates initial-access infrastructure from active collection infrastructure.

Key tradecraft points

• Infrastructure abuse: webhook[.]site (a legitimate service for testing HTTP requests) is used for C2, payload staging, and exfiltration, eliminating the need for dedicated attacker infrastructure and blending with regular network traffic.
• Evolution from HEADLACE: HOOKEDGE is described as a "direct evolutionary successor to HEADLACE," with similarities in core architecture and webhook[.]site abuse. HEADLACE has been used by APT28 against diplomats since April 2023.
• Continuous refinement: The implant was refined between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site.

4. Mitigation & containment

P1 — within 24 hours

• Block webhook[.]site at network egress. Apply DNS sinkhole and firewall egress blocks for webhook[.]site and its API endpoints. This disrupts the C2, staging, and exfiltration channel for both HOOKEDGE and HEADLACE. Assess business justification for any legitimate use of this service in your environment before blocking.
• Hunt for headless Edge C2. Search EDR and process telemetry for msedge.exe launched with headless or hidden-window flags, particularly from %userprofile% or scheduled-task contexts. This is the primary C2 transport mechanism.
• Hunt for scheduled tasks with 30-minute or 5-minute triggers. Query all endpoints for scheduled tasks with 30-minute or 5-minute repetition intervals that execute batch files or launchers from %userprofile%.

P2 — within 72 hours

• Disable macros via GPO. Ensure Office macro execution is disabled by default for all users, particularly those in government-liaison, public-affairs, or diplomatic-facing roles. HOOKEDGE's initial access depends entirely on the victim clicking "Enable Content."
• Hunt for the six-file drop pattern. Search for the creation of six files in %userprofile% following the opening of a Word document, followed by self-deletion of the installer components. This is a distinctive behavioural signature.
• Hunt for hidden-image beacons. Inspect Office document telemetry or email gateway logs for documents containing embedded images referencing webhook[.]site URLs — these fire on document open, before macro execution.
• Review Edge process lineage. Build detection logic for msedge.exe spawned by cmd.exe or wscript.exe/cscript.exe from a scheduled task context — legitimate Edge usage does not typically originate from batch-driven scheduled tasks.

P3 — within 7 days

• Brief high-risk user groups. Users in government relations, public affairs, compliance, and regulatory liaison functions should receive targeted awareness briefings on diplomatic-themed spearphishing lures impersonating government material.
• Update email gateway rules. Add detection for macro-enabled Word documents with diplomatic or government-themed lures targeting the above user groups, with particular attention to sender domain spoofing of Spanish, Romanian, and Turkish government entities.

5. Indicators of compromise

No atomic indicators of compromise (hashes, IPs, domains beyond the webhook[.]site service, file names) are available in the source material. The source describes the abuse of the legitimate service webhook[.]site but does not provide specific attacker-controlled webhook URLs, file hashes, or file names.

Behavioural indicators

6. Detection

rule HOOKEDGE_Backdoor_Batch_Implant {
    meta:
        author = "Adverse Trace"
        date = "2026-08-28"
        reference = "https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html"
        description = "Detects HOOKEDGE Windows batch backdoor based on reported behavioural artefacts: webhook.site C2, headless Edge execution, .cmd payload retrieval, HTML file exfiltration, polling loop"
    strings:
        $webhook_site = "webhook.site" nocase
        $headless_edge = "--headless" nocase
        $cmd_payload = ".cmd" nocase
        $edge_process = "msedge.exe" nocase
        $html_exfil = ".html" nocase
        $userprofile = "%userprofile%" nocase
    condition:
        4 of them
}

title: HOOKEDGE Backdoor Scheduled Task with 30-Minute or 5-Minute Repetition from User Profile
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects scheduled task creation with 30-minute or 5-minute repetition intervals executing from the user profile directory, consistent with HOOKEDGE backdoor persistence
author: Adverse Trace
date: 2026/08/28
references:

    - https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html
logsource:
    product: windows
    category: process_creation
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains:

            - '/create'
            - '-create'
    repetition_interval:
        CommandLine|contains:

            - '30'
            - '5'
    userprofile_path:
        CommandLine|contains:

            - '%userprofile%'
            - 'C:\Users\'
    condition: selection_schtasks and repetition_interval and userprofile_path
falsepositives:

    - Legitimate administrative scheduled tasks with short repetition intervals (tune by excluding known-good task names and service accounts)
level: high

title: Headless Microsoft Edge Launched from Batch or Scheduled Task Context
id: 8b4d2e3f-9c5a-4b7f-0d6e-2e3f4a5b6c7d
status: experimental
description: Detects Microsoft Edge launched in headless mode from cmd.exe or a scheduled task context, consistent with HOOKEDGE C2 and exfiltration behaviour
author: Adverse Trace
date: 2026/08/28
references:

    - https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html
logsource:
    product: windows
    category: process_creation
detection:
    selection_edge:
        Image|endswith: '\msedge.exe'
        CommandLine|contains:

            - '--headless'
            - '--window-position'
            - '--window-size'
    parent_batch:
        ParentImage|endswith:

            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\conhost.exe'
    condition: selection_edge and parent_batch
falsepositives:

    - Automated web testing or scraping tools using headless Edge (tune by excluding known development/testing hosts)
level: high

Threat actor context

APT28 · G0007 · aka IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. …

7. Sources

• The Hacker News, "APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations," https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html, 2026-08-28

8. Adverse Trace position

This is a moderate-severity advisory for EMEA financial services clients. The campaign targets government and diplomatic organisations, not financial institutions directly, and the tradecraft — batch-script implants, macro-enabled Word delivery, webhook[.]site C2 — is relatively low-sophistication despite the state-sponsored attribution. However, APT28 (MITRE G0007, attribution single-sourced to Recorded Future with moderate confidence) is a confirmed and persistent threat actor, and the techniques demonstrated (legitimate-service abuse for C2, headless browser exfiltration, anti-forensics) are directly transferable to financial-sector targeting, particularly against government-liaison and regulatory-affairs functions. Clients should block webhook[.]site at egress where no business justification exists, hunt for headless Edge C2 patterns and short-interval scheduled tasks from user-profile directories, and ensure macros are disabled by default. We will monitor for additional IOCs from Recorded Future's full report and for any indication of HOOKEDGE or HEADLACE variants targeting financial services.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.