BlueDelta Uses HOOKEDGE Backdoor in Campaigns Targeting European Government and Diplomatic Organizations
Summary
Recorded Future details BlueDelta campaigns from September 2025 to April 2026 that used macro-enabled Word documents to deploy HOOKEDGE against government and diplomatic targets in Romania, Spain, and Türkiye.
Key points
- Recorded Future attributes the campaigns, with moderate confidence, to BlueDelta, which overlaps with APT28, Fancy Bear, and Forest Blizzard and is linked to Russia’s GRU.
- Macro-enabled Word documents delivered HOOKEDGE through diplomatic-themed and generic lures, with victim interaction required to run the macros.
- HOOKEDGE is a Windows batch backdoor that retrieves commands from webhook.site, executes them, and sends output to separate webhook endpoints using Microsoft Edge.
- Scheduled tasks provide persistence; higher-priority targets received a second-stage payload that polled as often as every five minutes.
- The report finds code and tradecraft overlap with BlueDelta’s earlier HEADLACE backdoor, and describes changes to lures, execution methods, and beacon intervals.
- Recommended defenses include blocking macros in internet-originated documents, monitoring scheduled-task abuse and automated Edge execution, and reviewing outbound traffic to webhook services.
Article Details
- Attack Vectors
- BlueDelta used macro-enabled Microsoft Word documents, likely delivered as spearphishing attachments; enabling macros triggered the AutoOpen() subroutine.
- The documents dropped a batch-script backdoor and installer files, which established persistence through scheduled tasks.
- HOOKEDGE retrieved command payloads from webhook endpoints, executed them as .cmd files, and sent command output to separate webhook endpoints.
- The operation used document-open and email-open canary URLs to monitor phishing and document interaction.
- Defensive Notes
- Block macros in internet-originated documents where feasible and restrict unsigned VBA macro execution.
- Monitor for scheduled tasks that launch scripts or interpreters from user-writable directories.
- Investigate unusual Microsoft Edge automation, including headless or hidden execution and opening local HTML files or data URLs.
- Review outbound connections to webhook services, including webhook[.]site, and block services not required for business use.
- Use phishing-resistant MFA and maintain incident-response procedures for phishing, credential compromise, and suspicious scheduled-task creation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 001b57368c10bee9e62374e3b3f232b113eb75a1f198243d43a5bb90e1d0f500 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 231164362b2e4688e5d64ef7154845d655b649470bf995a79107b800ac5663b1 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 2793e7caba2f9beecd9b01baf41b8cb79f5a1a083ddedc6602ff23996bdc3104 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 2e320c457658d35a2bb7c420c53bdcc3916f01a7dd4572e5540e8fce923d201b | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 2e81945ba27108cc613a8aa6aca409ad6f5204e647d08dd9ef7c881c9d28667a | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 38f0e1e00d5c6d4afd96217556ba1dbe963298be4f9f0890fc1a7618bed009bd | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 58cfb8b9fee1caa94813c259901dc1baa96bae7d30d79b79a7d441d0ee4e577e | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 5f2a06bb1d1a210e9c477e4e5db439ce7b11fe9345d39b1b959905ba576a076a | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 74456a8d6042a4232071bee99e25d23046b993486d6d8a98ab296915bbb53395 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 7d8e98c0e322110021ae6d89f1a3ea090ef0741cf35b040dd4d0426a502d4845 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 877648c6ff448aa4efe1e3f004c089411285b8cb4139320e0dbec9d1d1bb3c77 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 87c15e4cf30098dcbfe9fd506c42896bf6d856aa77a70f312dd621b443b61dc3 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 8f18e02cbe1fa7abd280d2e070efe7af07e20cfe635f81140d6d347c292f8f44 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | 9c02d5429717001c55420730ee345c172e7ed89df3052b1e32b9bd122fce616d | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | aebf896b2f60c52af5d38c036159e0243632134643e8ad374cb64ed8cb09f360 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | b0f9f0a34ccab1337fbcca24b4f894de8d6d3a6f5db2e0463e2320215e4262e4 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | b1d037e9ff070d9722b7b289629d9b64a08ec35fd843cc01d37e6db69781ddcb | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | b8a1494b68617de92a3f58af8ca49dda4e9894f24c718ff3b26897a340e45c80 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | bfc008f57dca8c6bf341d9d7cf66cdad53faf8b1bcfbeded4593a60f129174b6 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | c6db004f2e8ff321d8a0e6d0134f2737d0f6ff79a4627a4b803ef926c107aa00 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | df60fa6008b1a0b79c394b42d3ada6bab18b798f3c2ca1530a3e0cb4fbbbe9f6 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | ed8f20bbab18b39a67e4db9a03090e5af8dc8ec24fe1ddf3521b3f340a8318c1 | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| SHA256 | f611e5415e21f229f75a42011d092e781ffe4118bb70ac95b9d85c41c81ef6ca | Malware sample hash listed in the HOOKEDGE campaign indicators. |
| URL | hxxp[:]//webhook[.]site/1e72b758-79e4-4c1c-90ed-7a8dc118f105 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxp[:]//webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg | Document-open canary URL used by BlueDelta to detect when a HOOKEDGE lure was opened. |
| URL | hxxp[:]//webhook[.]site/68d68fc7-aa94-4f2d-a727-d18fb40b0d69/docopened[.]jpg | BlueDelta campaign document-open canary URL listed as an IOC. |
| URL | hxxp[:]//webhook[.]site/c1d8ba4a-f044-4454-8b1c-b6866518f92c/doc[.]jpg | BlueDelta campaign document-open canary URL listed as an IOC. |
| URL | hxxp[:]//webhook[.]site/c29905ab-e5fa-446c-8958-4eab15d8fb80/docopened[.]jpg | BlueDelta campaign document-open canary URL listed as an IOC. |
| URL | hxxp[:]//webhook[.]site/c29905ab-e5fa-446c-8958-4eab15d8fb80/mailopened[.]jpg | BlueDelta campaign email-open canary URL listed as an IOC. |
| URL | hxxp[:]//webhook[.]site/c2e1be16-401b-4f60-8a0f-276b30417fda/docopened[.]jpg | BlueDelta campaign document-open canary URL listed as an IOC. |
| URL | hxxp[:]//webhook[.]site/d63049e3-1cbe-474b-9005-237517af53a7/docopened[.]jpg | BlueDelta campaign document-open canary URL listed as an IOC. |
| URL | hxxp[:]//webhook[.]site/d63049e3-1cbe-474b-9005-237517af53a7/mailopened[.]jpg | BlueDelta campaign email-open canary URL listed as an IOC. |
| URL | hxxps[:]//webhook[.]site/01d6a811-ae9a-4ecb-be3f-610075556304 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/272f1315-14d7-458c-a4ca-e2df423490b4 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/34f908b6-dd89-4600-b413-a29cd5e37a0b | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/36c9aecd-19f5-4564-a354-7708d947da8e | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/4e6cf717-e4d6-4f40-9f2d-134196fa5e7d | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/4e81a907-cc30-45c0-8bbd-5248e9f6dacd | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/4ef62d6a-90c0-4a70-8dd2-468879c70fd6 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/5744c020-a8d9-4755-abfb-cde6ccd450af | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/5dbed3be-f1c9-41e5-b5d5-e961d08b5fba | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/655a413e-4a66-4987-8f5b-f5cbfe34cdd6 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/68ff1679-974b-4d15-9ce0-799892c63f04 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/752c57b9-20d1-4990-a909-fd212ab71dcd | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/81f3d140-eb6e-4d72-a6ca-e6e952c3d9c2 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/82911ae6-ea27-4996-a664-2322e89da9ae | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/9f2837e2-8321-46a5-aee5-ccdda349f864 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/a3f4e990-0b2a-4f6a-a02e-c573005de3ee | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/a72d8905-b15f-4e95-9a8f-5e4bb7dc9b3d | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/bbdbf60c-8593-4660-9620-d3c0de24a8ab | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/c24a31e4-691e-4a7b-96af-037ae735d358 | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/cf25f91c-0a20-4339-834f-02f73e8bc75e | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
| URL | hxxps[:]//webhook[.]site/d993e113-a672-48aa-a382-64c5aaac56eb | BlueDelta campaign webhook endpoint listed as an IOC; associated with HOOKEDGE operations. |
MITRE ATT&CK
T1027.013 · Encrypted/Encoded FileThe report identifies encoded content in the JavaScript payloads and notes changes to VBA obfuscation.T1041 · Exfiltration Over C2 ChannelHOOKEDGE sent command output to a separate webhook endpoint used for exfiltration.T1053.005 · Scheduled TaskThe installer created scheduled tasks to run HOOKEDGE at recurring intervals.T1059.003 · Windows Command ShellHOOKEDGE is a Windows batch backdoor that executes retrieved .cmd payloads.T1059.005 · Visual BasicThe malicious Word documents use VBA macros, including an AutoOpen() subroutine, to launch the installer chain.T1070.004 · File DeletionThe installer deleted itself and other installation artifacts; HOOKEDGE also deleted temporary files after execution.T1071.001 · Web ProtocolsHOOKEDGE used HTTP requests through Microsoft Edge to communicate with webhook endpoints.T1074.001 · Local Data StagingHOOKEDGE staged downloaded command files, command output, and HTML exfiltration files on the infected host.T1083 · File and Directory DiscoveryHOOKEDGE inspected and handled files in the Downloads directory, including residual and downloaded payload files.T1105 · Ingress Tool TransferHOOKEDGE retrieved .75e payload files from staging webhooks before assembling and executing them.T1140 · Deobfuscate/Decode Files or InformationHOOKEDGE assembled downloaded payload fragments into .cmd files and processed encoded payload content.T1204.002 · Malicious FileExecution depended on recipients opening lure documents and enabling macros.T1567.004 · Exfiltration Over WebhookThe backdoor exfiltrated command output through webhook services.T1583.006 · Web ServicesBlueDelta used webhook services and unique endpoints for HOOKEDGE campaign operations.
Threat Actors
APT28The article says BlueDelta overlaps with activity publicly tracked as APT28; it does not explicitly state these names are aliases.BlueDeltaInsikt Group assesses with moderate confidence that BlueDelta conducted the HOOKEDGE campaigns.Fancy BearThe article says BlueDelta overlaps with activity publicly tracked as Fancy Bear; it does not explicitly state these names are aliases.
Malware
HEADLACEThis assessment is based on significant code and tradecraft overlap between HOOKEDGE and the HEADLACE backdoor used in prior BlueDelta campaigns, consistent infrastructure patterns, and targeting consistent with knownHOOKEDGEThe campaigns delivered a lightweight Windows batch-script backdoor, dubbed "HOOKEDGE," via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of the
Vendors
Microsoftcampaigns delivered a lightweight Windows batch-script backdoor, dubbed "HOOKEDGE," via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of theNordVPNAcross the observed campaigns, BlueDelta administered its webhook[.]site endpoints from NordVPN IP addresses.
Products
Microsoft Edgeinternet-originated documents and implementing detection coverage for scheduled task abuse, headless Microsoft Edge execution, and outbound connections to webhook services.Microsoft OfficeHarden Microsoft Office Macro Security: Disable macros from internet-originated documents where operationally feasible and enforce Microsoft’s recommended macro-blocking policies.Microsoft Wordcampaigns delivered a lightweight Windows batch-script backdoor, dubbed "HOOKEDGE," via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of the
Countries
MoldovaMoldovan officials, potentially reflecting an effort to collect intelligence relevant to Russia ahead of Moldova’s September 2025 parliamentary elections.RomaniaInsikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.SpainInsikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.TürkiyeInsikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.
Industries
Defense manufacturingBetween late September 2025 and early April 2026, BlueDelta conducted a series of initial access campaigns against defense manufacturing and diplomatic organizations in Romania, Spain, and Türkiye.DiplomacyGovernmentInsikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.