Russian state-sponsored hackers linked to APT28 — the group also known as Fancy Bear and Forest Blizzard — have been running a sustained espionage campaign against government and diplomatic organizations in Romania, Spain, and Türkiye. Researchers at Recorded Future’s Insikt Group, tracking the cluster as BlueDelta, observed the campaign running from late September 2025 through early April 2026, culminating in the deployment of a previously undocumented Windows backdoor called HOOKEDGE.
HOOKEDGE arrives as a macro-enabled Microsoft Word document using diplomatic-themed lures. When a target enables macros, the document writes six files to the %userprofile% directory and installs a scheduled task that runs the backdoor every 30 minutes. The backdoor itself is a Windows batch script that polls a webhook.site URL for arbitrary .cmd payloads, executes them, and exfiltrates the results — all through a headless Microsoft Edge browser instance to blend into normal network traffic. High-value targets receive a second-stage payload with a five-minute beaconing interval for more intensive collection. The technique mirrors APT28’s earlier HEADLACE backdoor — also distributed via Word macros and operated through webhook.site — which the group has used against European diplomats since at least April 2023. Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor to HEADLACE.