Russian cybercriminals have deployed a sophisticated Windows backdoor, known as HOOKEDGE, to conduct espionage against various diplomatic, governmental, and defense-oriented bodies across Europe. This operation has been particularly focused on nations such as Romania, Spain, and Turkey, where seemingly benign Microsoft Word documents have been used as the initial vector for intrusion.
Infiltration via Spearphishing
The method of attack involves spearphishing emails carrying documents with macros enabled. Victims are tricked into activating these macros, which then execute hidden scripts. These scripts make use of a deceptive Word error message to camouflage their malicious activity, transforming a single click into a persistent espionage channel.
According to PolySwarm, as reported in Cyber Security News, HOOKEDGE takes advantage of common Windows functions and a public webhook service to disguise its operations within normal web traffic. Research from Recorded Future links the campaign to the BlueDelta group and suggests that HOOKEDGE is an advanced version of the previous HEADLACE backdoor.
Stealthy Espionage Techniques
HOOKEDGE operations are notable for their preference for stealth over overt, high-tech methodologies. By mimicking traffic from Microsoft Edge and HTTPS services, the backdoor becomes difficult to distinguish from legitimate browsing, posing significant risks to entities reliant on document-based communication, especially those handling sensitive political or defense information.
Once activated, the macro scripts initiate a series of tasks, including creating scheduled tasks and removing installation traces to conceal the presence of malware. This mode of operation highlights the enduring vulnerability of trusted productivity tools as entry points for cyberattacks.
Operational Tactics and Detection
HOOKEDGE operates as a polling backdoor, periodically launching Microsoft Edge to fetch commands from a remote server and executing these instructions locally. This method involves a dual-instance approach, where one instance retrieves commands and another uploads the results, ensuring minimal traceability by deleting temporary files and artifacts.
The BlueDelta group, linked with the Russian GRU and associated with the well-known APT28 group, has targeted sectors reflecting longstanding Russian intelligence interests, including defense manufacturing and NATO-related activities. Adjustments in their tactics, such as obfuscating VBA code and altering beacon intervals, suggest a refined approach to evading detection.
Security teams are advised to regard unsolicited macro-enabled documents as high-risk, especially those pertaining to diplomatic or administrative themes. Implementing stringent controls over macros, monitoring scheduled tasks, and correlating unusual activities with command executions are essential for effective detection and prevention.
To stay ahead of evolving threats, organizations should focus on detecting behavioral patterns, such as the initiation of scripts by Word documents and the registration of tasks, which remain relevant even if the attackers modify their endpoints or malware structure.
