Russian Hackers Use New HOOKEDGE Malware to Spy on European Defense and Diplomatic Targets

Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies, and diplomatic organizations in Romania, Spain, and Türkiye.

The campaign relied on Word documents designed to look routine or official, turning a familiar office file into an entry point for espionage.

Victims were asked to enable macros, small automated commands embedded in documents. That action launched a chain of scripts that installed the backdoor, set it to run again through Windows Task Scheduler, and gave operators a route to collect data.

Analysts at Recorded Future’s Insikt Group identified the activity as the work of BlueDelta, a Russia-linked group also known as APT28, Fancy Bear, and Forest Blizzard. They assess with moderate confidence that it supported Russian intelligence collection.

Recorded Future said in a report shared with Cyber Security News (CSN) that the campaign matters because it shows how a simple tool can be hard to spot when it uses services and software that are normally trusted.

HOOKEDGE sends its traffic through a public webhook service and Microsoft Edge, leaving fewer obvious warning signs than a conventional attacker-controlled server.

Russian Hackers Use New HOOKEDGE Malware

BlueDelta used macro-enabled Word attachments, likely delivered in spearphishing emails, to start the intrusion.

Early samples impersonated material connected to Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, while later files used generic prompts asking recipients to enable content. This resembles weaponized Office document campaigns tied to APT28.

Once macros ran, the document wrote files into the user’s profile folder and launched an installer. It then created a scheduled task and deleted much of the installation trail.

Unfamiliar tasks that start scripts from user-writable folders deserve attention, as Windows scheduled task abuse can give intruders lasting access.

HOOKEDGE is a lightweight Windows batch-script backdoor. On each check-in, it asks a staging endpoint for a command, rebuilds that command into a file, runs it, and sends the result to a separate endpoint.

It uses hidden Edge browser sessions for both steps, making malicious requests look closer to ordinary browsing activity. For selected victims, the operators installed a second HOOKEDGE instance that checked in as often as every five minutes, rather than every 30 minutes.

This suggests a triage model: broad access, then faster collection from higher-value victims. It also echoes the group’s broader use of cloud service command channels to hide operations among legitimate traffic.

HOOKEDGE is an evolution of its earlier HEADLACE backdoor. The overlap covers batch scripting and browser-based communications.

Defenders Should Watch the Edges

The group refined the malware between September 2025 and April 2026, changing its lures, browser settings, and check-in timings.

In one important adjustment, the first-stage interval was extended to 61 minutes, a delay likely intended to outlast automated analysis systems that often observe a suspicious file for only an hour.

BlueDelta also used separate webhook endpoints to record email opens, document opens, commands, and stolen output. This structure helped operators measure which lures worked and preserve limited request quotas on the free service.

While public platforms are not malicious by themselves, organizations should review whether webhook services are needed and block unapproved use.

The report recommends blocking macros in documents downloaded from the internet where feasible, restricting unsigned VBA, and using phishing-resistant multifactor authentication.

Security teams should also investigate unusual Edge launches involving hidden or headless windows, local HTML files, or data URLs.

The technique is especially relevant as browser-led phishing attacks continue to blur the line between normal application activity and intrusion.

Incident-response teams should correlate suspicious document activity with new scheduled tasks, script interpreters, and outbound webhook connections.

Fast containment is important: HOOKEDGE is built to deliver follow-on commands, and a victim moved to the higher-frequency stage can give operators a much quicker path to ongoing surveillance.

They should preserve the original email and document, isolate affected hosts, and search for the published indicators before attackers can remove evidence or deploy a second-stage payload.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Russian Hackers Use New HOOKEDGE Malware to Spy on European Defense and Diplomatic Targets appeared first on Cyber Security News.