Loading malware…
HOOKEDGE is a lightweight Windows batch-script backdoor used in cyberespionage campaigns associated with BlueDelta, also tracked as APT28, Fancy Bear, and Forest Blizzard, a Russian GRU-linked threat group. It shares substantial code, architectural, and tradecraft similarities with HEADLACE. Observed targets include government, diplomatic, and defense-manufacturing organizations in Romania, Spain, and Türkiye, as well as naval shipbuilding, military aircraft engine manufacturing, and law enforcement organizations in European NATO countries.
HOOKEDGE is delivered through spearphishing emails carrying macro-enabled Microsoft Word documents with diplomatic themes or prompts to enable content. Macro execution launches a script-based installation chain that establishes persistence through Windows scheduled tasks. The backdoor periodically retrieves attacker-supplied command scripts, reconstructs and executes them, captures their output, and transmits the results to a separate collection endpoint. It uses headless or hidden Microsoft Edge instances and a legitimate public webhook service for command retrieval, payload staging, and output exfiltration, blending communications with ordinary browser traffic. Later deployments also used dedicated attacker-controlled infrastructure.
Installation components and temporary execution artifacts are deleted to reduce forensic traces. Observed configurations include 30-minute polling and additional implants checking in every five minutes for selected victims; later variants use 61-minute intervals. Operators have used HOOKEDGE access to conduct host and internal-network reconnaissance, capture credential material, establish reverse SSH tunnels, and deploy additional payloads. These follow-on activities are operator-directed rather than evidence of dedicated built-in modules.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Hookedge : backdoor capable de récupérer des instructions, exécuter des commandes et renvoyer les résultats. Il utilise une fenêtre Microsoft Edge cachée pour contacter webhook.site (service web légitime), rendant le trafic difficile à détecter.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
BlueDelta has continued to rely on webhook[.]site for all C2, payload staging, and data exfiltration across the campaigns documented in this report.
“The group used macro-enabled Word documents with diplomatic-themed lures to deliver HOOKEDGE.”
It creates a scheduled task that runs every 30 minutes, launching the HOOKEDGE launcher with the HOOKEDGE payload as its argument.
“the document’s AutoOpen routine writes batch, command, VBScript, HTML, and XHTML files into the user’s profile directory. These components start a multi-stage installer.”
HOOKEDGE is a lightweight Windows batch backdoor that enables remote command execution by retrieving arbitrary .cmd payloads from a staging webhook.
The document's AutoOpen() subroutine executes immediately, writing six files to the %userprofile% directory and launching the HOOKEDGE installer chain.
When a recipient opens a lure document and enables macros, the document's AutoOpen() subroutine executes immediately.
It creates a scheduled task that runs every 30 minutes, launching the HOOKEDGE launcher with the HOOKEDGE payload as its argument.
It creates a scheduled task that runs every 30 minutes, launching the HOOKEDGE launcher with the HOOKEDGE payload as its argument.
“The group adjusted its methods during the observed period, including changing lures, obscuring VBA code.”
The second-stage payloads retrieved by HOOKEDGE share JavaScript code ... using identical variable names, properties, structure, and base64 encoding schemes for automated file downloads.
“a fake Word error message tries to make the suspicious behavior seem routine.”
The installer then deletes itself, the installer launcher, and the task definition file, removing the primary installation artifacts.
Defense Evasion: Deobfuscate/Decode Files or Information — T1140.
“A later first-stage version waited 61 minutes between contacts, a delay likely intended both to conserve limited webhook requests and to outlast automated analysis systems that watch a file for roughly an hour.”
Relaunched Edge with a 1-pixel-by-1-pixel window size positioned far off-screen.
Discovery: File and Directory Discovery — T1083.
“A later first-stage version waited 61 minutes between contacts, a delay likely intended both to conserve limited webhook requests and to outlast automated analysis systems that watch a file for roughly an hour.”
Assembles an HTML exfiltration file by wrapping the command output between the pre-staged .htm header and .xhtml footer files dropped during installation.
Il utilise une fenêtre Microsoft Edge cachée pour contacter webhook.site
Hookedge : backdoor capable de récupérer des instructions, exécuter des commandes et renvoyer les résultats. Il utilise une fenêtre Microsoft Edge cachée pour contacter webhook.site
BlueDelta used HOOKEDGE ... as a delivery mechanism for additional HOOKEDGE payloads configured for more intensive, responsive tasking.
Exfiltration: Exfiltration Over C2 Channel — T1041.
“A second hidden Edge instance sends the collected output to a separate endpoint.”
“HOOKEDGE abuses legitimate webhook services for C2, payload staging, and data exfiltration…”
The assembled HTML file ... auto-submits a form on load and makes an HTTP POST request of the command output to the exfiltration webhook.
82 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used in an APT28 espionage campaign targeting defense-related organizations in two unnamed NATO countries. It retrieves instructions, executes commands, and returns results, initially communicating through webhook.site using a hidden Microsoft Edge window. Operators subsequently switched to a dedicated server at 185.82.218.119 for tasking and data transfer. Hookedge continued contacting attacker infrastructure after an SSH tunnel was closed, and its launcher was observed again on September 24, 2026.
Backdoor used by APT28 in an espionage campaign against defense and law enforcement organizations in two European NATO countries. The content describes its use to infiltrate systems, steal credentials and map internal networks. The campaign ran from July 24 to September 24, with no year specified.
Backdoor used by APT28 in an espionage campaign targeting European defense-related organizations and a law enforcement agency in two NATO member countries. It provides access to compromised systems, collects login credentials and supports internal network reconnaissance. Investigators could not confirm sensitive-data exfiltration or continuous access throughout the observed campaign.
Lightweight Windows batch-script backdoor attributed to APT28/Swallowtail. Delivered through spear-phishing attachments containing malicious Word macros, it launches Microsoft Edge in an off-screen, 1-by-1-pixel window to retrieve commands through webhook.site and report results. Scheduled tasks provide recurring execution, with beacon intervals adjusted across campaigns to evade observation. In the shipbuilder intrusion, a subsequent component used a dedicated command-and-control server. Follow-on operator activity included credential capture, reverse SSH tunneling, reconnaissance, and deployment of an unnamed reflective loader; the loader's encrypted payload remained unidentified.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.