BlueDelta Targets European Defense and Diplomacy with HOOKEDGE Backdoor

BlueDelta, a Russian state-sponsored threat group also known as APT28, Fancy Bear, and Forest Blizzard, has been conducting a persistent espionage campaign against defense and diplomatic organizations in Romania, Spain, and Türkiye. Operational between September 2025 and April 2026, the campaign utilizes a lightweight, modular backdoor dubbed HOOKEDGE. This malware is a refined successor to the HEADLACE backdoor and is delivered via spearphishing campaigns using macro-enabled Microsoft Word documents.

The HOOKEDGE implant is primarily composed of Windows batch scripts designed to execute commands and exfiltrate data by abusing legitimate internet services, specifically 'webhook[.]site'. This technique allows the group to blend malicious command-and-control (C2) traffic with normal network operations while maintaining a low footprint. The group has demonstrated significant tradecraft refinement during this period, including tailoring beaconing intervals based on target intelligence value to avoid detection and optimizing code to bypass sandbox environments. The use of diplomatic lures, including content impersonating the Spanish government, highlights the group's focus on intelligence collection aligned with Russian state interests.

Attack Chain

1. Initial access is established through spearphishing emails containing macro-enabled Microsoft Word documents.
2. The user is prompted to enable content, triggering the execution of an embedded malicious VBA macro.
3. The VBA macro drops and executes a Windows batch script (the HOOKEDGE backdoor) on the target host.
4. The HOOKEDGE backdoor initiates persistence mechanisms, typically via the creation of malicious scheduled tasks.
5. The backdoor performs environmental reconnaissance and determines its beaconing interval for the current session.
6. HOOKEDGE establishes C2 communication by sending HTTP requests to 'webhook[.]site' to retrieve follow-on commands or additional payloads.
7. The malware executes secondary payloads or commands, potentially invoking headless Microsoft Edge instances to further interact with the environment.
8. Stolen data is exfiltrated back through the same webhook infrastructure to conclude the collection mission.

Impact

The campaign targets sensitive government and diplomatic communications, potentially resulting in the compromise of classified policy documents, strategic meeting agendas, and regional intelligence related to European parliamentary elections. Observed victims include personnel in Romania, Spain, and Türkiye. Successful exploitation provides the adversary with persistent, low-profile access for ongoing espionage, enabling the exfiltration of high-value intelligence over extended periods.

Recommendation

• Implement Group Policy or Intune settings to block all macros in Office documents originating from the internet; this disrupts the primary delivery vector of HOOKEDGE.
• Enable Sysmon event ID 1 (Process Creation) and monitor for cmd.exe or powershell.exe spawned by WinWord.exe or Excel.exe.
• Monitor for the creation of new scheduled tasks using 'schtasks.exe' or 'powershell.exe' immediately following the execution of Office applications.
• Deploy network-level detection to flag outbound HTTP requests to known public webhook relay services like 'webhook[.]site'.
• Monitor for suspicious headless execution of Microsoft Edge ('msedge.exe') from non-interactive or service-related accounts.