HOOKEDGE: APT28’s Webhook-Based Espionage Backdoor

Key Takeaways

Recorded Future’s Insikt Group disclosed on August 28, 2026 a previously undocumented backdoor, HOOKEDGE, deployed against government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026 [1]. The activity is attributed with moderate confidence to BlueDelta, the Russian GRU-linked cluster tracked elsewhere as APT28, Fancy Bear, and Forest Blizzard, based on code and tradecraft overlap with HEADLACE, a modular backdoor the same operators have used against diplomats since April 2023 [1][2]. HOOKEDGE is a lightweight Windows batch-script implant delivered through macro-enabled Word documents carrying diplomatic-themed lures, and its defining characteristic is command-and-control routed entirely through webhook.site, a legitimate developer testing service, rather than through attacker-registered infrastructure [1][3]. The backdoor further disguises its network traffic by issuing requests through Microsoft Edge running in headless or hidden-window mode, so that outbound C2 and exfiltration traffic resembles ordinary browser activity to network defenders [1][4]. This campaign is an example of a broader tradecraft shift — sometimes described as “living off trusted services” — abusing free-tier SaaS and developer tooling that organizations rarely block by policy, a pattern CSA has also documented in nation-state abuse of Google Workspace administrative features [5].

Background

BlueDelta is an extensively documented GRU-affiliated intrusion set, publicly tracked under overlapping aliases including APT28, Fancy Bear, Forest Blizzard, Sednit, Sofacy, and ITG05, and attributed to Russia’s Main Directorate of the General Staff of the Armed Forces (GRU) [2]. Insikt Group’s prior research on the group’s HEADLACE backdoor documented a three-phase campaign running from April through December 2023 that used geofenced credential-harvesting pages and a modular dropper-launcher-backdoor chain against thirteen countries, with Ukraine accounting for roughly 40 percent of observed targeting alongside the Ukrainian Ministry of Defence, European railway infrastructure, and a defense-focused think tank in Azerbaijan [6]. HOOKEDGE is assessed as a direct evolutionary successor to HEADLACE, sharing identical JavaScript variable names and base64 encoding routines even though the two implants differ substantially in language and execution model, HEADLACE relying on VBScript components and HOOKEDGE on Windows batch scripting [1][2]. This continuity is consistent with an operator group that iterates deliberately on a stable tradecraft baseline rather than rebuilding tooling from scratch for each campaign.

The HOOKEDGE campaigns observed between late September 2025 and early April 2026 targeted government and diplomatic entities in three NATO member states — Romania, Spain, and Türkiye — including one, Türkiye, that is also an EU candidate country [1]. Early lures impersonated material from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, crafted shortly after a September 2025 meeting between Spanish and Moldovan officials that coincided with Moldova’s parliamentary elections, suggesting the operators calibrated their social-engineering themes to contemporaneous diplomatic events likely to interest recipients [1][3]. Later waves shifted to more generic “Enable Content” prompts rather than country-specific impersonation, a change consistent with an effort to generalize the lure across a wider set of targets once the initial thematic hooks had been exhausted [3][4]. The campaign’s overall geographic and sectoral footprint — government ministries and diplomatic missions rather than critical infrastructure or private industry — appears consistent with BlueDelta’s broader intelligence-collection priorities around European foreign policy, defense cooperation, and Ukraine-adjacent diplomacy, as reflected in its prior HEADLACE targeting [2][6].

Security Analysis

The HOOKEDGE intrusion chain begins with a macro-enabled Microsoft Word document delivered via spearphishing and disguised with diplomatic branding or a generic content-enablement prompt. Once a recipient enables macros, the document silently drops several files into the user’s profile directory and launches an installer chain that establishes persistence through a scheduled task before deleting the original dropped artifacts, likely to reduce the forensic footprint available to incident responders [3][4]. The scheduled tasks execute from GUID-formatted filenames within %userprofile%, a location that tends to blend more easily into legitimate user activity than system directories typically monitored by endpoint detection tooling [4].

HOOKEDGE’s most distinctive characteristic is its complete reliance on webhook.site, a free service designed for developers to inspect HTTP requests during testing, as its command-and-control backbone. The backdoor polls attacker-assigned webhook endpoints to retrieve arbitrary .cmd payloads, executes them locally, and posts the resulting output back to the same infrastructure using an HTML file, meaning the operators never need to stand up or maintain dedicated attacker-controlled servers [1][3]. Because webhook.site is a legitimate, widely used platform, outbound connections to it are less likely to trigger reputation-based network defenses than connections to a freshly registered domain, since the platform itself carries no adverse reputation history. The operators further constrained their own tradecraft to the platform’s limitations: the free tier caps each unique endpoint at 100 requests, so BlueDelta distributed tasking across dozens of separate endpoints — Insikt Group catalogued 32 distinct webhook.site URLs across the campaign — assigning specific endpoints to specific functions such as canary tracking, routine tasking, and exfiltration [1]. Administration of this endpoint infrastructure was itself obscured through NordVPN exit nodes, adding a further layer of attribution difficulty [1].

A second layer of evasion comes from how HOOKEDGE actually issues its network requests. Rather than using a custom HTTP client or common living-off-the-land utilities such as PowerShell’s Invoke-WebRequest or certutil, the backdoor drives Microsoft Edge itself, initially in explicit headless mode (--headless=new) and later, after the operators apparently recognized that headless Edge invocations are themselves a detectable anomaly, in a hidden-window mode that keeps the browser process visually suppressed while retaining ordinary browser network behavior [1][4]. This choice means the resulting traffic originates from msedge.exe, carries standard browser TLS fingerprints and headers, and is difficult to distinguish from legitimate employee browsing without specifically flagging anomalous automation flags or unusual parent-child process relationships involving the browser [1][4].

Beaconing intervals suggest a similarly deliberate operational tempo, based on how they changed over the campaign. Initial implants poll their assigned endpoint roughly every 30 minutes, a cadence later extended to 61 minutes in at least some deployments, apparently to frustrate the fixed-duration detonation windows used by automated malware sandboxes [1][3]. When operators identified a target as sufficiently high-value to warrant closer interaction, they deployed second-stage payloads beaconing every five minutes, trading operational security for responsiveness on a target-by-target basis [1][4]. The campaign also embedded hidden image references — files named variants of “docopened.jpg” and “mailopened.jpg” — inside lure documents and delivery emails, which silently call out to dedicated webhook.site canary endpoints the moment a message is opened or a document is rendered, giving operators real-time visibility into which targets engaged with a lure well before any macro executed [1][4]. This telemetry likely lets BlueDelta prioritize follow-on interaction with engaged targets and avoid deploying second-stage payloads on recipients who never opened the initial lure.

Insikt Group’s mapping of the campaign to the MITRE ATT&CK framework, summarized in Table 1, illustrates how thoroughly the operation was built around abusing legitimate services and processes rather than deploying custom malicious infrastructure.

Table 1: MITRE ATT&CK technique mapping for the HOOKEDGE campaign, as reported by Recorded Future’s Insikt Group [1].

The pattern HOOKEDGE exemplifies — command-and-control and exfiltration routed through a trusted third-party SaaS platform rather than attacker-owned infrastructure — is not unique to this campaign. CSA’s research note on the China-nexus actor UNC6508 documented a conceptually similar approach in which a state-aligned group weaponized a legitimate Google Workspace content-compliance rule to silently forward keyword-matched email to an attacker-controlled account, again avoiding any need for dedicated exfiltration infrastructure and evading detection controls tuned to flag anomalous outbound connections rather than misuse of an organization’s own administrative tooling [5]. Financially motivated actors have converged on the same principle from a different angle: CSA’s research on ShinyHunters’ OAuth-token campaigns describes a cluster that abused legitimate SaaS integration and authorization flows across Salesforce, Salesloft, and related platforms to move data out through channels that looked, to defenders, like ordinary application activity [7]. Across nation-state espionage and criminal extortion alike, the common thread is that trusted, widely deployed cloud and SaaS platforms increasingly function as attacker infrastructure of choice, in part because organizations are often unwilling or unable to block them outright.

Recommendations

Immediate Actions

Organizations in government, diplomatic, defense, and adjacent sectors that may be targets of BlueDelta or similarly resourced state-sponsored actors should disable macro execution from internet-originated Office documents wherever operationally feasible, a control Insikt Group specifically recommends and one that would likely have interrupted the HOOKEDGE chain at its earliest stage [1]. Security teams should also hunt for outbound connections to webhook.site and comparable request-inspection or webhook-relay services from endpoints where such traffic is not tied to a known business or development workflow, since blanket blocking may not be feasible but anomalous or unexplained use warrants investigation. Reviewing scheduled task creation events for tasks launching scripts from user-writable directories such as %userprofile%, particularly those using GUID-formatted filenames, offers a further high-signal detection opportunity specific to this campaign’s persistence mechanism [1][4].

Short-Term Mitigations

Defenders should build detections for Microsoft Edge (and other browsers) executing in headless mode or with automation-related command-line flags, as well as for browser processes making programmatic requests to domains inconsistent with typical user browsing patterns, since this technique is likely to see continued adoption, in part because it evades controls built around non-browser network clients [1]. Deploying phishing-resistant multi-factor authentication such as FIDO2 hardware keys across government and diplomatic user populations reduces the value of credentials obtained through related BlueDelta tradecraft, such as the geofenced credential-harvesting pages used in prior HEADLACE campaigns [1][6]. Security teams should also incorporate the 32 webhook.site URLs and 26 SHA-256 file hashes Insikt Group published as indicators of compromise into detection and threat-hunting workflows, while recognizing that BlueDelta’s demonstrated willingness to iterate — shifting from headless to hidden-window Edge execution mid-campaign — means indicator-based detection alone will have a limited shelf life against this operator [1].

Strategic Considerations

The structural lesson of HOOKEDGE, reinforced by the parallel tradecraft seen in UNC6508’s SaaS administrative-rule abuse and ShinyHunters’ OAuth-token campaigns, is that the perimeter organizations most need to instrument is no longer solely their own network edge but the full set of legitimate cloud and SaaS platforms their users and processes are permitted to reach [1][5][7]. Security teams should periodically inventory which webhook relay, request-inspection, file-sharing, and low-code automation services are reachable from managed endpoints by default, and apply egress controls or heightened monitoring to categories of service that offer attackers free, reputation-clean infrastructure. Incident response playbooks written primarily around attacker-registered domains and IP infrastructure should be extended to cover abuse of trusted, organization-approved third-party services, since attribution and takedown options differ substantially when the “infrastructure” in question is a legitimate vendor’s platform rather than attacker-controlled hosting.

CSA Resource Alignment

This campaign connects most directly to CSA’s research note on UNC6508’s espionage against medical and research networks, which documented a state-aligned actor weaponizing a legitimate SaaS administrative feature — a Google Workspace content-compliance rule — for silent, long-running data exfiltration [5]. Both campaigns illustrate the same underlying failure mode: detection programs tuned to flag anomalous external infrastructure miss abuse that occurs entirely within services an organization already trusts and has authorized. The recommendations in that note around auditing SaaS administrative configuration changes and treating administrative surfaces as Tier-0 infrastructure apply directly to organizations assessing their exposure to HOOKEDGE-style tradecraft.

CSA’s research note on ShinyHunters’ OAuth-token pivot across a year of SaaS supply-chain breaches documents a financially motivated cluster converging on the same broader principle — abusing legitimate SaaS authorization flows and integrations rather than deploying attacker-owned infrastructure — across Salesforce, Salesloft, and related platforms [7]. Read alongside HOOKEDGE, it underscores that “living off trusted services” is now a cross-cutting tradecraft pattern spanning both nation-state espionage and criminal extortion operations, not an isolated technique specific to one actor or motive.

Finally, the governance gap both campaigns expose — approved SaaS and developer platforms operating largely outside conventional network security monitoring — is a direct fit for the identity, logging and monitoring, and supply-chain domains of CSA’s AI Controls Matrix (AICM) v1.1, which, while framed around AI system governance, provides the same underlying control logic organizations need to extend to any third-party SaaS surface capable of relaying commands or data on an attacker’s behalf: least-privilege administrative access, change auditing on integration and automation configurations, and centralized logging that spans sanctioned third-party services rather than only owned infrastructure [8].

References

[1] Recorded Future Insikt Group. “BlueDelta Targets Defense and Diplomacy with HOOKEDGE.” Recorded Future, August 28, 2026.

[2] Recorded Future Insikt Group. “GRU’s BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaign.” Recorded Future, May 2024.

[3] The Hacker News. “APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations.” The Hacker News, August 28, 2026.

[4] Pierluigi Paganini. “Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations.” Security Affairs, August 2026.

[5] Cloud Security Alliance. “UNC6508: A Multiyear China-Nexus Campaign in Medical Research.” CSA AI Safety Initiative, June 2026.

[6] The Hacker News. “Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting.” The Hacker News, May 2024.

[7] Cloud Security Alliance. “ShinyHunters’ OAuth Pivot: A Year of SaaS Supply-Chain Breaches.” CSA AI Safety Initiative, July 2026.

[8] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, June 2026.