A Russia-linked espionage group is deploying a newly identified backdoor called HOOKEDGE against defense manufacturers, government institutions and diplomatic organizations in Romania, Spain and Türkiye. The campaign uses weaponized Microsoft Word documents as its entry point and relies on legitimate-looking services and browser processes to make command traffic less conspicuous.

Recorded Future’s Insikt Group attributed the activity to BlueDelta with moderate confidence. The actor is also tracked as APT28, Fancy Bear and Forest Blizzard and is widely associated with Russian intelligence collection. Researchers assessed the operation as an intelligence-gathering campaign aimed at high-value European targets.

Macros launch a quiet installation chain

The attacks begin with macro-enabled Word attachments, likely sent through targeted spear-phishing messages. Some documents impersonated material connected to Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, while later samples used more generic prompts asking recipients to enable active content.

If a victim enables the macros, embedded commands write several files into the user’s profile, start an installer and create a Windows scheduled task for persistence. The installation chain then removes portions of its trail. A scheduled task that launches scripts from a user-writable directory is an important detection opportunity because legitimate enterprise software rarely needs that combination.

HOOKEDGE itself is a lightweight Windows batch-script backdoor. It periodically requests a command from a staging endpoint, reconstructs and executes the instruction locally, then sends the output to a separate endpoint. This gives operators a flexible foothold for collecting information and delivering further commands without installing a large, feature-heavy implant.

Edge and webhooks disguise communications

The malware runs hidden Microsoft Edge sessions to retrieve instructions and return results. It also uses a public webhook service instead of relying solely on obvious attacker-owned infrastructure. Neither Edge nor webhook platforms are malicious by nature, which helps the traffic resemble ordinary browser and cloud-service activity.

Researchers observed separate webhook endpoints used to track email opens, document opens, commands and stolen output. That division could help the operators measure lure effectiveness and preserve usage quotas on free infrastructure. Selected victims received a second HOOKEDGE instance that checked for commands as often as every five minutes, compared with roughly 30 minutes for other systems. The faster interval suggests that operators triaged initial access and increased attention on higher-value targets.

The group refined the tool between September 2025 and April 2026. One version stretched its first-stage interval to 61 minutes, likely allowing it to outlast automated sandboxes that observe suspicious files for only an hour. HOOKEDGE also shares techniques with BlueDelta’s earlier HEADLACE backdoor, including batch scripting and browser-mediated communications.

Detection requires correlated signals

Defenders should prevent the initial execution where possible and correlate several weak signals that become compelling when seen together:

• Block macros in files downloaded from the internet and restrict unsigned VBA.
• Investigate hidden or headless Edge launches involving local HTML files or data URLs.
• Alert on new scheduled tasks that execute batch, command or VBScript files from user profiles.
• Review outbound connections to webhook services and block platforms that have no business use.
• Correlate suspicious Office activity with script interpreters, task creation and unusual browser processes.

Organizations that identify a suspected infection should isolate the host quickly, preserve the original email and attachment, and search across the environment for related tasks, scripts and network indicators. Because HOOKEDGE can execute follow-on instructions, the absence of a large payload does not indicate limited impact.

The campaign demonstrates how mature espionage groups continue to extract value from familiar techniques. Macros, scheduled tasks and batch scripts are not novel, but combining them with trusted browser processes, public cloud infrastructure and carefully tuned delays can frustrate defenses built around isolated indicators rather than behavioral chains.