Cybersecurity experts have identified new cyber campaigns targeting European government and diplomatic organizations, specifically in Romania, Spain, and Türkiye. These activities occurred between late September 2025 and early April 2026, marking a significant concern for cybersecurity within these regions.
Introduction of the HOOKEDGE Backdoor
Recorded Future’s Insikt Group has discovered a new backdoor tool called HOOKEDGE. This previously undocumented threat is a Windows batch script distributed via macro-enabled Microsoft Word documents. Initially, the attackers impersonated Spanish government documents before shifting to more sophisticated social engineering techniques.
The threat is linked to APT28, a Russian state-sponsored hacking group also known as Fancy Bear. The connection is made based on significant similarities between HOOKEDGE and an earlier backdoor known as HEADLACE, both used by APT28 in past cyber assaults on diplomats.
Technical Details and Impact
The HOOKEDGE backdoor uses Microsoft Word documents with embedded macros to infiltrate systems. When victims enable content, six files are written to the ‘%userprofile%’ directory, initiating the installation chain. The setup involves creating a scheduled task that runs every 30 minutes, executing the backdoor while erasing traces of its presence to hinder forensic investigations.
This backdoor also exploits webhook[.]site services for command-and-control operations. By blending malicious traffic with legitimate network activities, the attackers avoid setting up unique infrastructures, making detection more challenging.
Advanced Tactics and Future Outlook
BlueDelta, the group associated with APT28, has developed a two-stage deployment approach. The initial stage focuses on broad access, while the second stage targets high-value entities with more frequent beaconing intervals, ensuring sustained command-and-control capabilities without exhausting resources.
Based on evolving defensive strategies, APT28 has adapted its tactics, removing some initial indicators of compromise to better conceal their activities. Organizations are urged to block macro execution from external sources and monitor for scheduled task abuses and unusual network connections.
In conclusion, the ongoing threat posed by APT28 and its HOOKEDGE backdoor underscores the need for enhanced cybersecurity measures. Recorded Future emphasizes the importance of adapting to these persistent threats, highlighting the group’s focus on refining existing tools over introducing new ones, ensuring operational resilience amidst evolving defenses.
