BlueDelta's HOOKEDGE Espionage Campaign Targets European Governments
Recorded Future’s Insikt Group has documented a cyber espionage campaign attributed to BlueDelta, a Russian group linked to the GRU, which overlaps with APT28. This operation targeted European government entities, utilizing webhook.site as its command-and-control infrastructure. The campaign spanned from late September 2025 to early April 2026, focusing on diplomatic organizations in Romania, Spain, and Türkiye.
The attackers employed macro-enabled Microsoft Word documents to deliver a backdoor named HOOKEDGE, using diplomatic-themed lures. One such document impersonated Spain’s Ministry of the Presidency, created shortly after a significant meeting between Spanish and Moldovan officials. This timing coincided with Moldova’s parliamentary elections, enhancing the phishing attempt's credibility.
HOOKEDGE operates using a simple Windows batch script and relies on two webhooks: one for receiving commands and another for sending stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file via Microsoft Edge, executing it and transmitting the results to a designated endpoint. By utilizing Edge, the malware disguises its traffic as regular web activity, complicating detection by security tools.
A notable feature of HOOKEDGE is its use of msedge.exe for both tasking and data exfiltration, blending its communications with legitimate browsing activity. This strategy minimizes the likelihood of detection by security systems. Furthermore, HOOKEDGE shares significant code and structural similarities with HEADLACE, another backdoor previously used by BlueDelta, indicating a continuity in their operational methods.
The operation also included a mechanism for prioritizing targets. When a victim exhibited signs of being a high-value target, BlueDelta deployed a secondary HOOKEDGE payload that checked in every five minutes, allowing for more immediate control. This two-tiered approach also addressed limitations of webhook.site’s free tier, which caps requests per endpoint.
BlueDelta continuously refined its operation, adjusting beaconing intervals to evade detection by sandbox environments that typically monitor behavior for limited durations. The group incorporated tracking mechanisms within their phishing documents, allowing them to monitor when emails and documents were opened, akin to marketing analytics but with malicious intent.
For cybersecurity defenders, the report outlines clear indicators for detection. Recommendations include blocking macros in documents from the internet, monitoring scheduled tasks that execute scripts from user-writable folders, and flagging unusual activity from Microsoft Edge. These measures do not require advanced tools, suggesting that even a well-configured monitoring system could identify these behaviors early.
Insikt Group assesses that BlueDelta is likely to persist in targeting European government and diplomatic organizations, driven by the strategic importance of these entities in Russian intelligence operations. The ongoing geopolitical dynamics ensure that the intelligence requirements motivating this activity will remain significant in the foreseeable future.
