"The implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site," Recorded Future said.
Recorded Future links the activity to APT28 (BlueDelta)
Recorded Future's Insikt Group publicly described a cluster of campaigns that targeted government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. The company attributed the activity with moderate confidence to a Russian state-sponsored hacking group known as APT28 (aka Fancy Bear and Forest Blizzard), which Recorded Future tracks under the moniker BlueDelta. The attribution rests on "significant code and tradecraft overlap" between the newly observed implant, HOOKEDGE, and HEADLACE, a modular Windows backdoor previously used by APT28 in attacks against diplomats since April 2023.
HOOKEDGE: a lightweight Windows batch backdoor
HOOKEDGE is a basic Windows batch-script backdoor distributed in macro-enabled Microsoft Word documents with diplomatic-themed lures. When executed, HOOKEDGE runs a polling loop that fetches arbitrary .cmd payloads from a staging webhook, runs those commands, and sends resulting output back to the webhook URL via an HTML file. Command retrieval and data exfiltration are performed by launching Microsoft Edge in headless mode or in a hidden window to make HTTP requests to webhook endpoints. Following each operation, temporary files are deleted and any process whose window title matches the HOOKEDGE task identifier is terminated.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDelivery, persistence, and forensic cleanup
The primary infection vector is a macro-enabled Word document that prompts the user to click "Enable Content." The macro writes six files to the "%userprofile%" directory and launches a HOOKEDGE installer chain. That chain begins with an installer launcher that creates a scheduled task set to run every 30 minutes and execute the HOOKEDGE launcher with the backdoor as its argument. The main installer then deletes itself, the installer launcher, and the task definition file from the directory in an apparent attempt to reduce forensic artifacts and complicate incident response. Early lure documents also embedded a hidden image referencing a webhook[.]site URL that alerted operators when the document was opened; Recorded Future notes BlueDelta later removed that document-open canary, likely to reduce network-based indicators of compromise.
Webhook[.]site abuse and the two-stage architecture
Recorded Future highlights the group's repeated use of webhook[.]site services for command-and-control, payload staging, and data exfiltration. That choice lets malicious activity blend with regular network traffic and avoids the need for dedicated infrastructure. The firm observed BlueDelta deploying a second-stage HOOKEDGE payload against high-value victims with a beaconing interval as little as five minutes to increase operational control. That two-stage model also addresses a practical constraint: webhook[.]site's free tier imposes a maximum of 100 requests per unique endpoint, and a 30-minute beaconing interval would exhaust a given endpoint's allocation within approximately two to three days. By shifting high-priority victims to dedicated second-stage webhook endpoints, BlueDelta separates initial-access infrastructure from active collection infrastructure and preserves request quotas for ongoing operator tasking and collection.
What this means for technologists, European governments, and policymakers
- Technologists and security teams: Recorded Future recommends prioritizing blocking macro execution from internet-originated documents and implementing detection coverage for scheduled task abuse, headless Microsoft Edge execution, and outbound connections to webhook services. The observed installer behavior, scheduled-task persistence, and headless-browser C2 should inform detection and response playbooks.
- European government and diplomatic organizations: The campaigns specifically targeted organizations in Romania, Spain, and Türkiye using diplomatic-themed lures; early documents imitated Spanish government material before shifting to broader social engineering lures a month later. Those organizations may be the intended intelligence-collection targets that BlueDelta's tooling is designed to reach and refine.
- Policymakers and platform operators: The observed operational adjustments — removing a document-open canary and splitting access between initial and second-stage webhook endpoints to work around 100-request limits — underscore how defenders' environmental constraints (including free-tier API limits) can shape attacker tradecraft. Monitoring abuse of publicly available webhook services and considering controls on macro-enabled document handling are specifically highlighted by Recorded Future's findings.
Recorded Future summarizes BlueDelta's approach as continued investment in "lightweight, easily adaptable initial-access tooling" to support intelligence collection against European government and diplomatic targets. Rather than introducing new capabilities, the group has steadily refined existing tradecraft to emphasize operational resilience — adapting established tooling to evade sandboxing, conserve limited webhook request quotas, and reduce observable network indicators. Those concrete adjustments — two-stage webhook usage, scheduled-task persistence, headless Edge C2, and the removal of canaries — are the immediate traces defenders can hunt for; they also signal that the actor will likely keep iterating until those signatures are mitigated.
