BlueDelta (APT28) Targets European Governments with HOOKEDGE Backdoor via Webhook

An Espionage Campaign Between September and April

Between late September 2025 and early April 2026, government and diplomatic organizations in Romania, Spain, and Turkey were targeted by a cyber espionage campaign attributed to BlueDelta, the Russian group also known as APT28, Fancy Bear, or Forest Blizzard. The activity was documented by Insikt Group, Recorded Future’s threat intelligence division, which reconstructed the operation from observed samples and infrastructure. According to the analysis, the attribution to BlueDelta is expressed with moderate confidence, but it is consistent with the group’s profile: a Russian state-aligned threat linked to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation, the GRU.

The objective was to collect information from European government and diplomatic entities. The three targeted countries have different characteristics but share a strategic interest for Moscow: Romania for NATO’s eastern flank, Spain for its relations with Latin America and the Mediterranean, and Turkey for its role as an interlocutor between Europe, the Caucasus, and the Middle East. Insikt Group believes that BlueDelta will continue to conduct initial access campaigns of this kind, because Russian intelligence requirements on European governance, NATO, and relations with former Soviet republics are unlikely to decrease in the near term.

Word Documents with Macros as a Diplomatic Lure

The initial access vector consisted of macro-enabled Microsoft Word documents paired with diplomatic-themed lures. In at least one case, the document impersonated Spain’s Ministry of the Presidency, Justice and Relations with the Cortes. The lure was created shortly after an actual meeting between Spanish and Moldovan officials in September 2025, close to the Moldovan parliamentary elections that same month. This is significant: the document’s content was credible enough to make the phishing attempt plausible, and the timing suggests that BlueDelta operators were monitoring real diplomatic developments to build timely lures.

The exact Microsoft Office versions involved were not disclosed. The attack nevertheless exploited a well-established technique: convincing the victim to enable macros in a Word document received by email. Once executed, the macros downloaded and installed the next-stage payload, the HOOKEDGE backdoor.

HOOKEDGE: A Batch Backdoor Leveraging Edge and webhook.site

The distributed payload is a lightweight backdoor written as a Windows batch script, called HOOKEDGE. Its architecture is deliberately simple: it uses two webhooks, one to receive commands and one to exfiltrate stolen data. Every 30 minutes, a scheduled Windows task downloads a command file through Microsoft Edge, executes it, and sends the results to a remote endpoint. It does not use a commonly abused LOLBin or a custom binary.

The most distinctive aspect is the use of msedge.exe, the Microsoft Edge browser, for both command retrieval and exfiltration. By generating network traffic through a legitimate application, the malware blends its communications with normal corporate browsing activity. To a traffic analyst, requests to webhook.site appear as an employee visiting websites, not as a command-and-control channel. This evasive strategy reduces the need for sophisticated infrastructure, relying entirely on blending with legitimate traffic.

The infrastructure backbone was webhook.site, a service originally designed to let developers test HTTP requests. Choosing a free public service allowed BlueDelta to keep operational costs low and hide among many other users’ traffic, but it also introduced constraints, such as the 100-request-per-endpoint limit on the free plan.

From HEADLACE to HOOKEDGE: Controlled Evolution

HOOKEDGE was not developed from scratch. Insikt Group detected significant code and structural overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns. Similarities include identical JavaScript variable names and the same base64 encoding scheme for automated downloads. Based on these elements, the company assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor to HEADLACE, maintained by the same operators rather than a new tool created by a different team.

This is consistent with BlueDelta’s habit of refining already working tactics over time rather than reinventing them. The shift from HEADLACE to HOOKEDGE is not a break but an adaptation: a lighter, simpler backdoor that is harder to distinguish from normal traffic.

Triage and Optimizations: From Beaconing to Canary Pixels

The campaign included a triage mechanism. When a victim showed signs of interest—for example active communication with the initial webhook endpoints—BlueDelta deployed a second HOOKEDGE payload configured to check in every 5 minutes instead of 30. This allowed operators much faster interactive control over higher-value targets. The two-tier structure also solved an infrastructure problem: given the 100-request-per-endpoint limit, separating ordinary tasking from high-priority tasking on different endpoints prevented a single endpoint from being exhausted during the operation.

During the campaign, BlueDelta also repeatedly adjusted operational parameters. Beaconing intervals were extended from 30 to 61 minutes. The choice is deliberate: most sandbox environments observe a sample’s behavior for only an hour, so a 61-minute interval allows the malware to remain idle long enough to pass automated analysis without generating traffic.

The group also added canary tracking pixels, with names such as mailopened.jpg and docopened.jpg. They served to precisely monitor when the phishing email was opened, when the document was opened, and when macros were actually executed. In practice, BlueDelta built a kind of analytics for its phishing funnel: it knew which lures worked and which victims deserved the high-frequency payload.

The malicious document contained a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This served as a canary for document opening. In later variants the file name was doc.jpg instead of docopened.jpg. Insikt Group also identified webhooks named mailopened.jpg, indicating the use of a similar mechanism to detect phishing email opens.

Impact and Attribution to the GRU

No CVSS scores were provided, and this is not a single vulnerability with a CVE identifier. The threat should nevertheless be considered high for government and diplomatic sectors: it is cyber espionage attributed to a Russian state-aligned group, with a direct impact on information confidentiality. The campaign hit European government and diplomatic entities in three countries, but the potential reach is broader: the technique is replicable and the webhook.site-based infrastructure is difficult to block in advance.

According to Insikt Group, BlueDelta will likely continue to conduct initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. The assessment is based on the enduring strategic importance of European governance, NATO-related issues, and diplomatic relations with former Soviet republics. These intelligence requirements are unlikely to decrease in the near term, making further evolution of the group’s tools and tactics likely.

Practical Mitigations for Organizations

The countermeasures suggested by Insikt Group are concrete and do not require complex tools. The first is to block macro execution in documents downloaded from the Internet: many productivity suites allow disabling them by default or restricting them to documents signed by trusted sources. The second is to monitor Windows scheduled tasks that launch script interpreters from user-writable folders: HOOKEDGE uses precisely this mechanism to execute downloaded commands. The third is to detect Microsoft Edge in headless mode or automated connections to file-hosting and webhook services that the organization does not legitimately use. In many cases, a well-configured monitoring system should be able to identify these behaviors already in the early stages of infection.

For detection, administrators can look for the presence of canary files such as docopened.jpg, doc.jpg, or mailopened.jpg, connections to webhook.site, msedge.exe executions in headless mode, and scheduled tasks that launch batch scripts from user-writable paths. Given the use of webhook.site and Edge as the C2 channel, it is also useful to block or restrict access to unauthorized webhook domains and to log msedge.exe activity that deviates from normal interactive browsing. The simplicity of HOOKEDGE is a double-edged sword: it makes the malware difficult to distinguish, but it also exposes it to close monitoring of scheduled tasks and traffic to unusual services.