Russian Hackers Use New HOOKEDGE Backdoor to Spy on European Organizations

Russian hackers have used a Windows backdoor called HOOKEDGE in espionage operations against diplomatic, government, and defense-related organizations across Europe.

The activity focused on targets in Romania, Spain, and Turkey, where seemingly ordinary Microsoft Word attachments became the opening move in a staged intrusion.

The campaign relies on spearphishing emails carrying macro-enabled documents. Victims are urged to enable content, which launches hidden scripts while a fake Word error message tries to make the suspicious behavior seem routine. The approach turns one unsafe click into a persistent channel for remote spying.

PolySwarm said in a report shared with Cyber Security News (CSN) that HOOKEDGE uses familiar Windows features and a public webhook service to blend into normal web traffic.

The report draws on Recorded Future research, which linked the activity to BlueDelta with moderate confidence and described the malware as an evolution of the earlier HEADLACE backdoor.

The campaign matters because it favors quiet, low-cost access over flashy tools. By making its traffic appear to come from Microsoft Edge and an HTTPS service, the backdoor can be harder to separate from legitimate browsing.

That creates a risk for organizations that depend on document-based communication and sensitive political or defense information.

Russian Hackers Use New HOOKEDGE Backdoor

Once macros run, the document’s AutoOpen routine writes batch, command, VBScript, HTML, and XHTML files into the user’s profile directory.

These components start a multi-stage installer, create a Windows scheduled task, and later remove installation traces. Similar use of Office lures has appeared in an earlier weaponized Office document campaign, showing how trusted productivity files remain valuable entry points.

HOOKEDGE works as a polling backdoor. At set intervals, it opens Microsoft Edge to retrieve instructions from a staging endpoint, joins the returned content into a command file, runs it, and captures the result.

A second hidden Edge instance sends the collected output to a separate endpoint, while temporary files and download artifacts are deleted.

This split between tasking and data theft helps the operators keep one compromised service from exposing the whole operation. It also avoids the need to maintain a conventional command server.

Security teams should look beyond domain reputation alone, because browser-based traffic to a legitimate web platform may not stand out without process and behavior monitoring.

Researchers observed two levels of victim handling. A first-stage scheduled task could contact operators every 30 minutes, while selected victims received another HOOKEDGE instance that checked in as often as every five minutes. That faster communication gives operators a responsive way to collect intelligence after deciding a victim is valuable.

Tiered Espionage and Detection

BlueDelta is assessed as a Russian state-sponsored group associated with the GRU and publicly tracked as APT28, Fancy Bear, and Forest Blizzard.

Its targets align with long-running Russian intelligence interests in government, diplomacy, defense manufacturing, Moldovan political affairs, and NATO-adjacent activity. The targeting pattern reinforces concern about broader APT28 attacks on Europe.

The group adjusted its methods during the observed period, including changing lures, obscuring VBA code, moving from headless Edge execution to hidden windows, and changing beacon intervals.

A later first-stage version waited 61 minutes between contacts, a delay likely intended both to conserve limited webhook requests and to outlast automated analysis systems that watch a file for roughly an hour.

Defenders should treat unsolicited macro-enabled attachments, especially those tied to diplomatic or administrative themes, as high risk.

They should disable or tightly control macros from internet-sourced files, review new and modified scheduled tasks, and correlate suspicious Edge launches with unusual command shells or script files.

Monitoring for scheduled task persistence techniques can expose activity that simple file scans miss. Teams should also preserve endpoint and proxy logs before responding, since HOOKEDGE removes temporary artifacts that could otherwise explain the intrusion.

Detection should focus on relationships: Word starting scripts, scripts registering tasks, and Edge posting data to unusual webhook paths. This behavior-first approach remains useful even if operators replace their endpoints or slightly rework the malware.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.