APT28-Linked BlueDelta Deploys HOOKEDGE Backdoor in European Espionage Campaigns

Severity

Medium

A new espionage campaign attributed to the Russian-linked BlueDelta group has been targeting government, diplomatic, and defense organizations across Europe with a lightweight Windows backdoor known as HOOKEDGE.

The campaign was observed against organizations in Romania, Spain, and Türkiye from late September 2025 through early April 2026. Newer HOOKEDGE variants identified in June and July 2026 show that the attackers have continued changing their phishing documents, execution techniques, and command-and-control infrastructure.

BlueDelta, also known as APT28, Fancy Bear, and Forest Blizzard, relies on a combination of malicious Office documents, Windows scripting, scheduled tasks, Microsoft Edge, and third-party webhook services to maintain access while keeping its activity relatively low-profile.

How?

The attack begins with spearphishing emails containing malicious Microsoft Word documents. Early lures were designed to look like legitimate diplomatic communications, including documents impersonating material from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes.

Later campaigns moved toward generic Word documents containing junk text and instructions asking victims to click “Enable Content.” Once macros are enabled, the document’s AutoOpen() routine writes several malicious files to the user’s profile directory, including batch, command, VBScript, HTML, and XHTML files.

A fake Microsoft Word error message is then displayed to the victim, making the document appear to have failed while the malicious components continue running in the background.

The HOOKEDGE backdoor does not depend on a traditional compiled malware executable. Instead, it primarily uses Windows batch scripts together with legitimate software to carry out its operations. Persistence is established through a scheduled task.

After deployment, HOOKEDGE communicates with attacker-controlled infrastructure hosted through webhook[.]site. It periodically retrieves commands from a webhook endpoint, creates a .cmd file containing the received commands, and executes them on the compromised system.

The resulting command output is collected and formatted into an HTML file. Microsoft Edge is then used to send the collected information to a separate webhook endpoint through an HTTP POST request.

Using msedge.exe for network communication allows the malware’s traffic to blend in with legitimate browser activity. The use of a legitimate webhook service also reduces the need for the attackers to operate their own dedicated C2 infrastructure.

The attackers adjusted HOOKEDGE’s communication frequency depending on the target. Some systems were configured to check in every 30 or 61 minutes, while higher-value victims received a second HOOKEDGE instance that communicated every five minutes. This approach allows the attackers to maintain a quieter presence on less important systems while enabling faster interaction with selected targets. The 61-minute interval may also help the malware avoid sandbox environments that monitor activity for roughly one hour. At the same time, the longer interval reduces the number of requests sent to the webhook service.

Overall, the activity shows how BlueDelta can combine relatively simple Windows scripting with trusted applications and online services to maintain access without relying on a sophisticated standalone malware payload.

The use of malicious Office macros, suspicious scheduled tasks, unusual Microsoft Edge executions, unexpected connections to webhook services, and temporary .bat, .cmd, .vbs, .htm, and .xhtml files in user-profile directories may indicate malicious activity.

IOCs

SHA-256 Hash

206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991
231164362b2e4688e5d64ef7154845d655b649470bf995a79107b800ac5663b1
58cfb8b9fee1caa94813c259901dc1baa96bae7d30d79b79a7d441d0ee4e577e
5f2a06bb1d1a210e9c477e4e5db439ce7b11fe9345d39b1b959905ba576a076a
87c15e4cf30098dcbfe9fd506c42896bf6d856aa77a70f312dd621b443b61dc3
9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc
aebf896b2f60c52af5d38c036159e0243632134643e8ad374cb64ed8cb09f360
b0f9f0a34ccab1337fbcca24b4f894de8d6d3a6f5db2e0463e2320215e4262e4
c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44
df60fa6008b1a0b79c394b42d3ada6bab18b798f3c2ca1530a3e0cb4fbbbe9f6
ed8f20bbab18b39a67e4db9a03090e5af8dc8ec24fe1ddf3521b3f340a8318c1
f611e5415e21f229f75a42011d092e781ffe4118bb70ac95b9d85c41c81ef6ca

Source

https://gbhackers.com/russian-apt28-linked-hackers-deploy-hookedge-backdoor/