Blocking a known attacker’s infrastructure only works while the attacker needs infrastructure of their own. The group behind HOOKEDGE decided it didn’t.
What researchers found
Security researchers have attributed a new Windows backdoor, dubbed HOOKEDGE, to APT28 (also tracked as Fancy Bear and BlueDelta), a Russian state-sponsored hacking group, with moderate confidence based on code and tradecraft overlap with HEADLACE, an implant the same group has used against diplomats since 2023. Between September 2025 and April 2026, the group ran a campaign against government and diplomatic organisations in Romania, Spain and Turkiye, delivering the backdoor through macro-enabled Word documents carrying diplomatic-themed lures, early versions impersonated Spanish government material before the group shifted its social engineering approach.
The part worth paying attention to
HOOKEDGE is a lightweight Windows batch script, and its command-and-control runs through webhook.site, a legitimate, free service developers use to inspect and test HTTP webhooks. That choice means the malware’s network traffic looks like ordinary developer tooling rather than a callback to attacker-owned infrastructure, so it doesn’t need dedicated servers that a blocklist can catch up to, and blocking the service outright breaks a tool that developer teams genuinely rely on. Researchers also note the implant was refined continuously through the campaign, adapting to sandbox detection and free-tier API limits, evidence of an actively maintained operation rather than a one-off tool.
Why this matters beyond ministries and embassies
Government and diplomatic staff were this campaign’s targets, but the delivery method, a macro-enabled Word document with a plausible pretext, and the evasion technique, hiding C2 inside a trusted SaaS tool, generalise to any organisation that receives document attachments from external senders. Legal firms, consultancies, defence contractors and any business handling correspondence tied to European government contracts sit in the same threat model even when they are not the primary target.
What defenders should do
Disable macros in Office documents by default and require explicit justification to re-enable them for specific workflows. Make sure your email security and endpoint tooling can flag anomalous outbound connections to generic webhook and automation services, not just known-bad IP ranges, since living-off-trusted-services is exactly the technique this campaign relies on. And treat diplomatic, government or contract-themed attachments arriving unexpectedly, even from what looks like a known sender, as worth a second look before opening.
If you want your organisation’s email security and endpoint defences assessed against this kind of living-off-trusted-infrastructure technique, contact Excello Digital. We help European organisations close the gap between a phishing email that gets through and a backdoor that gets noticed.