BlueDelta (APT28) Uses HOOKEDGE Backdoor in Espionage Campaign

Executive Summary

Insikt Group, the research division of Recorded Future, has identified a targeted espionage campaign attributed to BlueDelta, a Russian state-sponsored threat group linked to the GRU and also tracked as APT28 and Fancy Bear. The campaign, active from late 2025 to early 2026, targeted government and diplomatic entities in Romania, Spain, and Türkiye. The attackers used a new, simple backdoor named HOOKEDGE, delivered through spear-phishing emails with malicious macro-enabled documents. A key feature of this campaign is the abuse of webhook.site, a legitimate web service, for command and control (C2), making the malicious traffic difficult to distinguish from benign developer activity.

Threat Overview

What Happened: A Russian APT group conducted a cyber-espionage campaign against European government targets using a new backdoor that leverages a legitimate web service for C2.

Attacker: BlueDelta (APT28, Fancy Bear, Forest Blizzard). This is a highly sophisticated threat actor associated with Russia's General Staff Main Intelligence Directorate (GRU). They are known for conducting espionage, disruption, and disinformation campaigns aligned with Russian strategic interests.

Victims: Government and diplomatic organizations in Romania, Spain, and Türkiye.

Malware: HOOKEDGE, a lightweight backdoor written as a Windows batch script. Its primary function is to establish a C2 channel, download commands, execute them, and exfiltrate the results.

Technical Analysis

The attack chain begins with a spear-phishing email containing a malicious Microsoft Word document. The document uses diplomatic-themed lures to trick the target into enabling macros.

1. Delivery: A macro-enabled Word document (.docm) is sent to the target. One observed lure impersonated Spain's Ministry of the Presidency.
2. Execution: When macros are enabled, the HOOKEDGE batch script is dropped and executed.
3. Persistence: The malware establishes persistence by creating a scheduled task that runs every 30 minutes.
4. Command and Control (C2): This is the most innovative part of the attack. HOOKEDGE uses two unique URLs on the legitimate webhook.site service.
   • One URL is used to fetch commands from the attacker.
   • The other URL is used to exfiltrate stolen data and command output via HTTP POST requests.
   • The script uses Microsoft Edge in headless mode (--headless) to perform the C2 communication, further blending in with normal user activity.

This abuse of a legitimate service for C2 is a clever defense evasion technique, as blocking the domain webhook.site would impact legitimate developers and users.

MITRE ATT&CK Techniques

• Initial Access:
  • T1566.001 - Spearphishing Attachment: The use of malicious Word documents sent via email.
• Execution:
  • T1059.005 - Visual Basic: The malicious macros in the Word document.
  • T1059.003 - Windows Command Shell: The HOOKEDGE backdoor is a batch script.
• Persistence:
  • T1053.005 - Scheduled Task: Used to run the backdoor every 30 minutes.
• Defense Evasion:
  • T1027 - Obfuscated Files or Information: Macros are typically obfuscated.
  • T1140 - Deobfuscate/Decode Files or Information: The macro decodes and drops the batch script.
  • T1071.001 - Web Protocols: Using HTTP/HTTPS for C2.
  • T1219 - Remote Access Software: Abusing the legitimate webhook.site service for C2 functions.
• Command and Control:
  • T1105 - Ingress Tool Transfer: Downloading commands from the webhook URL.

Impact Assessment

This campaign represents a continued effort by Russian intelligence services to conduct espionage against NATO members and European government entities. The theft of diplomatic and government documents can provide Russia with strategic advantages, insight into policy decisions, and material for future influence operations. The use of a simple yet effective backdoor that abuses a legitimate service demonstrates the actor's ability to innovate and adapt its TTPs to bypass traditional security controls. Organizations that do not have granular control and visibility over their network traffic may completely miss this type of C2 activity.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as file hashes or webhook URLs were provided in the source articles.

Cyber Observables — Hunting Hints

• Network Traffic: Monitor for any outbound connections to webhook.site from servers or user workstations that do not belong to developers or have a legitimate business need. This is the strongest indicator.
• Process Creation: Look for instances of schtasks.exe creating tasks with suspicious command lines, especially those executing batch scripts from temporary directories.
• Command Line Pattern: Hunt for msedge.exe or chrome.exe being executed with the --headless flag, especially when initiated by a script or scheduled task. This is highly anomalous for typical user activity.
• File System: Search for recently created batch files (.bat, .cmd) in user profile directories (%APPDATA%, %TEMP%).

Detection & Response

• Network Traffic Analysis: The key to detection is monitoring and scrutinizing traffic to legitimate-but-abusable services like webhook.site. Implement D3FEND's Outbound Traffic Filtering (D3-OTF) and create specific alerts for any non-developer systems communicating with such sites.
• Endpoint Detection (EDR): Use an EDR to monitor for the full attack chain: Word spawning a command shell, which in turn creates a scheduled task, which then executes Microsoft Edge in headless mode. This chain of events is highly suspicious.
• Macro Security: Configure Microsoft Office applications to block macros from the internet and enforce macro signing.

Mitigation

• Application Control: Use application control solutions like AppLocker to restrict the execution of batch scripts from user-writable directories. This aligns with Executable Allowlisting (D3-EAL).
• Email Security: Employ advanced email security gateways to block malicious attachments and scan for suspicious macros.
• User Training: Train users, especially those in high-risk departments like government and diplomacy, to be skeptical of unsolicited attachments and to report suspicious emails.
• Egress Filtering: While blocking webhook.site entirely may be disruptive, consider logging all connections to it and similar services for manual review. For high-security environments, deny access by default and only allow it for specific users or systems with a justified need.