HOOKEDGE is a Windows backdoor used against government and diplomatic organisations in Romania, Spain and Türkiye between late September 2025 and early April 2026.

It is a batch script.

What it actually does

It polls. At intervals it fetches a .cmd payload from a staging webhook, executes it, and returns the output by writing an HTML file back to a webhook URL.

That is the entire command-and-control design. No custom protocol, no encrypted beacon format, no compiled implant — a scheduled fetch of a text file from webhook[.]site, a free service anyone can sign up for in a browser.

Recorded Future's Insikt Group notes that abusing webhook.site for staging, command-and-control and exfiltration lets the activity blend with regular traffic while removing the need to stand up dedicated infrastructure at all.

Why boring is the point

There is a persistent assumption that state-sponsored means technically elaborate. This is the counter-example, and it is more instructive than a clever one would be.

A batch file is not scanned like an executable. Traffic to a legitimate webhook service is not blocked, because plenty of real software uses it. There is no attacker-controlled domain to add to a blocklist, no infrastructure to seize, and nothing to reverse-engineer beyond a few lines of readable script.

Sophistication here means choosing the thing that generates no signal. Every design decision trades capability for invisibility, and against a diplomatic target that trade is obviously correct.

The operational tells

Three details show a team paying attention:

  • Two-stage targeting. High-value victims receive a second-stage payload with beaconing intervals as short as five minutes, keeping initial-access infrastructure separate from active collection.
  • Anti-forensics. The installer deletes itself, its launcher files and the task definitions once installed.
  • Adaptation. Operators removed the document-open canaries that had been capturing victim IP addresses, apparently to reduce network-visible indicators.

That last one means somebody read the detection writeups and changed the tooling in response. The canary was useful to them and they gave it up because it was noisy.

The delivery is a macro. In 2026.

HOOKEDGE arrives as a macro-enabled Word document with a diplomatic lure. The victim clicks Enable Content to see the contents, and the macro writes six files into the user profile directory and starts the chain. Early variants impersonated Spanish government material.

Macro-enabled documents from the internet have been blocked by default in Office for years. This still works, which means the documents are reaching people through channels where that block does not apply, or being opened by people who cleared the warning.

On the attribution, and the word Recorded Future used

Insikt Group attributes this to APT28 — also called Fancy Bear or Forest Blizzard, and tracked internally as BlueDelta — with moderate confidence.

That qualifier is doing real work and most coverage will drop it. The basis given is significant code and tradecraft overlap between HOOKEDGE and HEADLACE, a modular Windows backdoor deployed against diplomats since April 2023, with both sharing core architecture and identical webhook.site abuse patterns.

Shared code and shared tradecraft are good evidence. They are not proof, because tooling is shared, sold and copied, and this site has spent the month arguing that attribution offered early and confidently is exactly what a false flag is designed to exploit. Recorded Future has stated its confidence level honestly. Reporting it as "Russia did it" would be a claim the researchers did not make.

What to do

  • Block macro-enabled documents from external sources, and check that the policy actually applies to the paths documents arrive by.
  • Alert on outbound traffic to webhook.site and similar request-bin services. Legitimate use exists; it should be a known, short list.
  • Hunt for unexpected .cmd execution and for scheduled tasks created and then deleted.
  • Look at the user profile directory for clusters of files written together.
  • Do not tune detections to the file format. The technique survives the batch script being replaced with anything else that polls.

What is not established

  • Initial infection vectors beyond the macro-enabled documents.
  • What was actually taken from any target.
  • Whether any victim detected or stopped the intrusion.
  • The full capability set beyond command execution and data return.
  • Encryption and obfuscation details of the communications.