- The Mess: Russian-linked BlueDelta, also tracked as APT28, deployed a previously undocumented Windows backdoor called HOOKEDGE against government, diplomatic and defense targets in Romania, Spain and Türkiye. The malware uses weaponized Word documents, scheduled tasks and legitimate webhook services, while Microsoft Edge quietly handles command-and-control traffic and data exfiltration.
- The Damage: The attacker doesn’t need a sophisticated custom network implant when the victim’s own browser can carry commands and stolen data through traffic that looks like ordinary web activity.
- The Fix: Block macros in documents originating from the Internet, monitor scheduled-task abuse and investigate unexpected headless or automated Microsoft Edge activity and connections to webhook services.
APT28 didn’t need another spectacular malware framework.
They built something smaller.
Something quieter.
Something that looks suspiciously like normal Windows activity.
It’s called HOOKEDGE.
And its favorite disguise is Microsoft Edge.
The Old Trick Still Works
The campaign starts with something defenders have been fighting for years:
a malicious Microsoft Word document.
BlueDelta used diplomatic-themed documents designed to look legitimate, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes.
The targets were organizations in Romania, Spain and Türkiye, with activity observed between late September 2025 and early April 2026. Recorded Future’s Insikt Group attributes the campaign to BlueDelta with moderate confidence.
The victim opens the document.
Then comes the familiar:
Enable Content.
That’s the moment the attack gets moving.
Six Files. One Scheduled Task.
When the malicious macro executes, it writes multiple files into the user’s profile directory and launches the HOOKEDGE installation chain.
The installer creates a scheduled task.
The initial configuration runs approximately every 30 minutes.
The installer and several temporary files are then deleted to reduce the forensic footprint.
Nothing here sounds revolutionary.
That’s precisely the point.
Attackers don’t need revolutionary techniques when boring Windows functionality still works.
HOOKEDGE Is Almost Embarrassingly Small
HOOKEDGE is a lightweight Windows batch-script backdoor.
It doesn’t need a massive executable.
It doesn’t need a complicated custom C2 protocol.
It can simply retrieve a command, execute it and return the result.
The malware uses two webhook endpoints:
one for receiving commands
one for sending results back
The infrastructure relies on the legitimate webhook.site service.
That creates another layer of camouflage.
Instead of connecting to an obviously malicious server controlled by the attacker, the malware communicates with a legitimate web service used by developers for testing HTTP requests.
And Then Edge Gets Involved
This is the clever part.
HOOKEDGE uses msedge.exe to retrieve commands and exfiltrate the results.
In some configurations Edge runs headless or with its window hidden.
From the network’s perspective, the malware isn’t necessarily generating traffic that screams:
“I AM A BACKDOOR.”
It’s generating traffic through a browser.
Microsoft Edge.
A program that already belongs on almost every Windows machine.
That’s a much harder signal to separate from normal enterprise traffic.
The Browser Becomes the C2 Channel
Think about what normally happens inside a company.
Thousands of machines run Edge.
They connect to hundreds of websites.
They download content.
They make HTTPS requests.
They contact external services.
Now imagine a malicious script using the same browser to retrieve commands.
The traffic isn’t automatically invisible.
But it can blend into an environment where defenders already expect enormous amounts of browser activity.
That’s the trick.
Don’t hide the malware.
Make the malware look like something everyone already trusts.
The Commands Are Ordinary
HOOKEDGE retrieves .cmd payloads from its staging webhook.
It executes them.
The output is then sent back through the second webhook endpoint.
Temporary files are deleted afterward.
So the backdoor doesn’t need to implement every capability itself.
The attackers can simply send new commands when they need something done.
That’s enough to turn a tiny batch script into a remote-control mechanism.
High-Value Targets Get a Faster Version
BlueDelta also appears to use a two-stage approach.
The first-stage implant can beacon every 30 minutes.
If the victim turns out to be interesting enough, the operators deploy a second-stage configuration with beaconing intervals as short as five minutes.
That’s smart operationally.
Most victims get lightweight monitoring.
The valuable ones get more attention.
The attackers don’t waste infrastructure or noisy communications on everyone.
They triage.
Even the Phishing Campaign Has Analytics
The Word documents themselves contained hidden images pointing to webhook URLs.
Opening the document could therefore generate a request that told the attackers the lure had been opened.
Other filenames such as mailopened.jpg and docopened.jpg were used as canaries.
In other words, BlueDelta wasn’t simply sending phishing documents.
It was measuring the campaign.
Email delivered.
Email opened.
Document opened.
Macro executed.
Target compromised.
That’s basically an attacker-side conversion funnel.
Except the customer is the victim.
HOOKEDGE Didn’t Come From Nowhere
Recorded Future found significant similarities between HOOKEDGE and HEADLACE, another backdoor previously associated with BlueDelta.
The overlap includes code structure, techniques and abuse of webhook services.
Recorded Future assesses HOOKEDGE as a direct evolutionary successor rather than an entirely unrelated malware family.
That makes sense.
Successful attackers rarely throw away working infrastructure.
They modify it.
Improve it.
Reduce detection.
Change the timing.
Move the C2.
Keep the parts that work.
They Even Changed the Timing to Beat Sandboxes
One of the more interesting modifications involved the beaconing interval.
Security sandboxes frequently observe malware for a limited period.
If the malware waits long enough before contacting its command server, automated analysis might conclude:
nothing happened.
BlueDelta adjusted the timing in some versions to extend beyond typical sandbox observation windows.
The malware doesn’t have to be invisible.
It only needs to be boring for long enough.
This Is Not a New Windows Zero-Day
That’s worth making clear.
HOOKEDGE doesn’t require a spectacular Windows vulnerability.
It uses:
Word macros
scheduled tasks
batch scripts
Microsoft Edge
webhooks
All legitimate or long-established Windows capabilities.
The attack works by combining them.
That’s often more difficult to defend against than a single obvious exploit.
What Defenders Should Hunt
There are several useful signals here.
Watch for Word documents attempting to execute macros.
Monitor scheduled tasks created by Office documents or scripts.
Investigate unexpected instances of Edge running in headless mode.
Look for automated Edge processes making repeated connections to webhook services.
And don’t ignore scripts executing from user-writable directories.
None of these indicators individually proves compromise.
Together?
They deserve attention.
Recorded Future specifically recommends monitoring scheduled-task abuse, headless Edge execution and outbound connections to webhook services.
Bugstoday Opinion
This is exactly the kind of malware we expect to see more often.
Not because HOOKEDGE is technically revolutionary.
It isn’t.
It’s interesting because it shows how attackers are getting better at using normal software as camouflage.
Microsoft Edge isn’t the vulnerability.
Word isn’t the vulnerability.
Scheduled Tasks aren’t the vulnerability.
Webhook services aren’t the vulnerability.
Put them together and you get a surprisingly effective espionage platform.
And that’s the annoying part.
Defenders can’t simply block everything that looks unusual.
They have to understand why Edge is running, who launched it, what it is connecting to and why a scheduled task suddenly appeared after someone opened a Word document.
Bugstoday verdict: HOOKEDGE is small, ugly and effective. A Russian-linked group took a batch script, a Word macro, a scheduled task and a legitimate browser and turned them into an espionage chain aimed at European government and diplomatic targets. The most dangerous malware isn’t always the one hiding deepest in Windows. Sometimes it’s the one hiding in plain sight behind msedge.exe.
