Cybersecurity researchers have identified a series of cyberattacks targeting government and diplomatic institutions in Romania, Spain, and Türkiye between late September 2025 and early April 2026, according to a report published Thursday by Recorded Future's Insikt Group. The campaigns delivered a previously unknown backdoor called HOOKEDGE, a simple Windows batch script spread through macro-laced Microsoft Word documents designed to look like diplomatic correspondence. The researchers attribute the activity with moderate confidence to APT28, a Russian state-sponsored hacking group also known as Fancy Bear and Forest Blizzard.
HOOKEDGE arrives as a macro-enabled Word document that asks victims to click "Enable Content" to view the file, triggering malicious code that writes six files to the user profile directory and launches an installer chain. The installer creates a scheduled task that runs every 30 minutes to execute the HOOKEDGE launcher with the backdoor as its argument, then deletes itself along with the installer launcher and task definition file to erase traces of the intrusion. The lure document also contains a hidden image pointing to a webhook[.]site URL that notifies attackers the moment a victim opens it. Once active, HOOKEDGE enters a polling loop to enable remote command execution by retrieving arbitrary .cmd payloads from a staging webhook, running them, and transmitting the output back via an HTML file. Command retrieval and data theft occur by launching Microsoft Edge in headless mode or a hidden window to make HTTP requests to the webhook, after which all temporary files are wiped and any process matching the HOOKEDGE task identifier is killed.
The report describes HOOKEDGE as a "direct evolutionary successor to HEADLACE," an earlier modular Windows backdoor APT28 used against diplomats since April 2023, noting "significant code and tradecraft overlap" between the two tools. Both share similarities in core architecture and abuse webhook[.]site services for command-and-control, payload staging, and data exfiltration, letting malicious activity blend into normal network traffic without requiring dedicated infrastructure. According to Recorded Future, "the implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site." Against high-value targets, the threat actors deploy a second-stage HOOKEDGE payload with a beaconing interval as short as five minutes, giving them tighter operational control over tasking and interactive post-compromise activity.
The attackers continually adapted their approach to work around infrastructure limitations and defensive countermeasures, Recorded Future explains. The free tier of webhook[.]site caps requests at 100 per unique endpoint, meaning a 30-minute beaconing interval would exhaust an endpoint's quota in roughly two to three days. By shifting high-priority victims to dedicated second-stage webhook endpoints, the group separates initial-access infrastructure from active collection infrastructure, ensuring ongoing operator tasking doesn't prematurely burn through the limited request quotas of first-stage webhooks. This two-stage architecture lets the first-stage implant focus on broad initial access, with information from that phase used to identify victims of higher intelligence value and escalate collection against them. The group also removed the document-open canary that captured victim IP addresses, a change Recorded Future suspects is likely an attempt to reduce network-based indicators of compromise. The report recommends organizations prioritize blocking macro execution from internet-sourced documents and implement detection coverage for scheduled task abuse, headless Microsoft Edge execution, and outbound connections to webhook services. Recorded Future concludes that the group "continues to invest in lightweight, easily adaptable initial-access tooling to support intelligence collection against European government and diplomatic targets," emphasizing operational resilience by refining established tools rather than building new capabilities. The persistence of such campaigns suggests that adversaries will continue iterating on proven techniques as long as macro-enabled documents and legitimate cloud services remain accessible attack vectors. Organizations facing nation-state threats must weigh the operational convenience of legacy features against the tactical advantage those same features hand to patient, adaptive adversaries.