Researchers at Recorded Future’s Insikt Group said the activity ran from late September 2025 to early April 2026 and was attributed with moderate confidence to BlueDelta, a cluster that overlaps with APT28, Fancy Bear and Forest Blizzard. Western security agencies have linked APT28 to Russia’s GRU military intelligence service.
HOOKEDGE is a lightweight Windows batch-script implant delivered through macro-enabled Microsoft Word documents. The documents used diplomatic themes and, in some cases, impersonated official Spanish government material before later campaigns shifted towards more generic prompts asking recipients to enable document content.
Once a victim enabled macros, the malicious document dropped a series of files into the user profile directory and established persistence through a scheduled task. The backdoor then used Microsoft Edge, operating in headless or hidden-window mode, to retrieve commands, execute them through Windows command processes and return the results to attacker-controlled channels.
A notable feature of the operation was its reliance on webhook. site, a legitimate service intended for testing web requests. Insikt Group said BlueDelta used the service for command-and-control communication, payload delivery and data exfiltration rather than relying solely on infrastructure registered directly by the attackers.
That approach can make hostile traffic harder to distinguish from normal activity because communications are routed through a legitimate internet service. Researchers said the operators repeatedly changed webhook endpoints and adjusted the timing between connections, partly to manage limits imposed by the service and partly to reduce the chance of automated analysis detecting the implant.
The campaign also appears to have separated targets by intelligence value. Systems assessed by the attackers as more important could receive a second-stage HOOKEDGE instance with a shorter beaconing interval, giving operators faster access for command execution and follow-on collection.
The earliest activity identified by researchers involved a document impersonating material associated with Spain’s Ministry of the Presidency, Justice and Relations with the Cortes. The lure was created shortly after a September 2025 meeting involving Spanish and Moldovan officials, leading researchers to assess that some targeting may have been connected to intelligence requirements surrounding Moldova’s parliamentary election.
Between October and December 2025, the attackers moved towards less specific social-engineering documents, including files displaying prompts to enable content and fake Microsoft Word error messages. Insikt Group said those campaigns likely targeted organisations in Romania.
Additional variants identified in early April 2026 were linked through network telemetry to organisations in Türkiye. Public reporting has not identified the victim organisations, and there has been no public confirmation from the governments concerned that specific institutions were successfully compromised.
Researchers said HOOKEDGE shares substantial code and operational similarities with HEADLACE, another malware family associated with BlueDelta. The overlap includes naming conventions, encoding routines and the use of legitimate web services, leading Insikt Group to assess that HOOKEDGE is an evolutionary successor to the earlier implant.
The attribution is consistent with wider assessments of APT28 by European and allied cyber-security authorities. Britain’s National Cyber Security Centre said in April that APT28 is almost certainly Russia’s GRU Unit 26165 and described the group as a highly skilled threat actor involved in espionage operations against government, diplomatic, defence and technology targets.
The same unit has been accused by Western governments of conducting multiple cyber operations against organisations supporting Ukraine and other NATO-linked interests. Authorities have documented the group’s use of spear-phishing, credential theft, exploitation of vulnerable infrastructure and customised malware across separate campaigns.
HOOKEDGE, however, relies on comparatively simple native Windows components rather than a large compiled malware framework. That design reduces dependencies on additional software and allows the implant to blend with tools already present on a Windows system.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
