Researchers have uncovered a fresh cyberespionage effort by a Russian-linked hacking group known as APT28, also called Fancy Bear or Forest Blizzard. The operation, active between late September 2025 and early April 2026, has been deploying a new Windows backdoor dubbed HOOKEDGE to infiltrate government and diplomatic entities in Romania, Spain, and Türkiye. The findings come from a threat intelligence analysis led by Recorded Future’s Insikt Group. HOOKEDGE is delivered via macro-enabled Microsoft Word documents that use diplomatic-themed decoys. Early versions imitated Spanish government paperwork, later shifting toward broader social engineering lures.
What is HOOKEDGE and How It Works
HOOKEDGE is a lightweight backdoor implemented through Windows batch scripting. Once the target enables macros in the malicious Word document, HOOKEDGE writes several files to the user profile directory and initiates a scheduled task that triggers every 30 minutes. That task runs the backdoor launcher, enabling remote command execution. After launching, the installer deletes itself along with its creator files to erase traces and complicate incident response.
The malware reaches out to infrastructure hosted on webhook.siteboth for staging malicious payloads and exfiltrating data. It retrieves commands in the form of .cmdfiles, executes them, and funnels output back using either a hidden or headless instance of Microsoft Edge. All temporary artifacts are then erased. For high-value targets, operators activate a second-stage payload that beacons every five minutes to maintain tighter operational control. This tiered design aims to preserve webhook[.]site’s limited free service quotas—a shift necessary after initial access endpoints would be overrun after just two or three days under heavier traffic.
Attribution and Tradecraft Overlap
Recorded Future assesses with moderate confidence that APT28 is behind HOOKEDGE, citing strong similarities with the group’s previous backdoor malware known as HEADLACE, which has been utilized against diplomats since April 2023. The overlapping techniques include backend service abuse for command-and-control, similar core architecture, and data exfiltration methods. APT28 appears to be refining its operations, not reinventing them.
Earlier iterations of HOOKEDGE included a hidden “canary” image in lure documents to capture victims’ IP addresses when the document was opened. That feature has since been removed, likely to reduce detectable network indicators and fortify the group’s stealth. The adjustment shows the adversary closely watches defensive tools and adapts swiftly.
Suggested defenses for organizations include disabling or tightly controlling macro execution from documents received via email or the internet, monitoring for misuse of scheduled tasks, detecting hidden or headless browser sessions, particularly Microsoft Edge, and scrutinizing outbound connections to webhook-style endpoints.
The significance of this operation lies in its contrast to typical ransomware or high-profile disruptive threats: this is intelligence-gathering conducted with subtlety. APT28 is counting on low-visibility, low-friction tools rather than flashy exploits. The evolution from HEADLACE to HOOKEDGE underscores how nation-state attackers are optimizing for longevity and stealth in hostile environments. Organizations in Europe—and elsewhere—should expect more of this kind of threat, and defenders must elevate detection at the earliest stages: lure delivery, macro activation, task scheduling, and covert C2 channels. Defensive readiness will increasingly decide who gets compromised and who doesn’t.
