HOOKEDGE: How APT28 Hides Espionage in Free Webhooks

Analysts at Recorded Future's Insikt Group have observed a series of campaigns aimed at government and diplomatic organizations in Romania, Spain and Turkey. The attacks ran from late September 2025 through early April 2026 and led to the deployment of a previously unknown backdoor dubbed HOOKEDGE.

The activity is attributed with moderate confidence to the Russian group APT28 (also known as Fancy Bear and Forest Blizzard; Recorded Future tracks it as BlueDelta). The basis is substantial overlap in code and techniques with the HEADLACE backdoor, which APT28 has been using against diplomats since April 2023. HOOKEDGE is described as its direct evolutionary successor.

A simple batch file instead of complex malware

HOOKEDGE is a lightweight batch script for Windows. It is delivered through macro-enabled Microsoft Word documents with diplomatic lures: early versions posed as Spanish government materials, while the approach later shifted toward social engineering. The moment a victim clicks “Enable Content,” the macro writes six files into the user's directory and kicks off the installation chain.

A scheduled task is then created that launches the backdoor every 30 minutes. The installer deletes itself, its launcher and the task file in an effort to cover its tracks and complicate any investigation. An image hidden in the document reaches out to a URL on webhook[.]site and notifies the operators that the victim has opened the file.

Everything rides on webhook.site

The most notable part is that command-and-control and data exfiltration are built on the free webhook[.]site service. In a loop, the backdoor polls the webhook, downloads arbitrary .cmd payloads, executes them and sends the results back. Requests are made using the Microsoft Edge browser in headless mode or in a hidden window, which lets the attackers avoid standing up their own infrastructure and blend into ordinary traffic.

This thriftiness has a downside: the free tier is capped at a hundred requests per endpoint, and with a 30-minute interval the limit is exhausted in two or three days. So against especially valuable targets a second stage of HOOKEDGE is deployed, with an interval of just five minutes and a separate webhook. In this way the group separates its initial-access infrastructure from its data-collection infrastructure — in effect working around its own resource constraints.

Throughout the period from September to April, the implant was continuously refined: the authors adapted to sandboxes and stripped-down API limits, and they also removed a “canary” that had exposed victims' IP addresses when the document was opened — likely to reduce network indicators of compromise.

Recorded Future stresses that BlueDelta is not inventing new capabilities but methodically polishing its existing toolkit, betting on operational resilience. For defense, it recommends blocking macro execution in documents from the internet and monitoring for abuse of scheduled tasks, launches of Edge in headless mode, and outbound connections to webhook services.

Source: The Hacker News