APT28 Deploys New HOOKEDGE Backdoor Against European Government and Diplomatic Entities

New Backdoor Identified in APT28 Campaigns

Cybersecurity researchers have identified a new backdoor, dubbed HOOKEDGE, used in recent campaigns attributed to the Russian state-sponsored hacking group APT28 (also known as Fancy Bear and Forest Blizzard). These campaigns targeted government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026.

Technical Details of HOOKEDGE

HOOKEDGE is a lightweight Windows batch script delivered through macro-enabled Microsoft Word documents. These documents use diplomatic-themed lures to entice targets into enabling macros. Early versions impersonated Spanish government material before switching to a social engineering approach.

The backdoor establishes persistence by creating a scheduled task that runs every 30 minutes. It also attempts to cover its tracks by deleting installer files and task definitions to complicate forensic analysis.

Attribution and Evolution

Attribution to APT28 is based on significant code and tradecraft overlap between HOOKEDGE and HEADLACE, another modular Windows backdoor previously used by APT28. Both backdoors utilize webhook[.]site services for command-and-control, payload staging, and data exfiltration, allowing malicious activity to blend with regular network traffic.

HOOKEDGE is considered a direct evolutionary successor to HEADLACE, undergoing continuous refinement to evade automated sandbox environments and adapt to API limits on webhook[.]site.