Defense and Diplomacy Targeted with HOOKEDGE

BlueDelta, associated with the APT28 threat actor, targeted government and diplomatic entities in Romania, Spain, and Türkiye using HOOKEDGE, a lightweight Windows batch-script backdoor delivered via macro-enabled Word documents with diplomatic-themed lures. HOOKEDGE abuses legitimate webhook services for command-and-control, payload staging, and data exfiltration, sharing significant code and tradecraft overlap with the previously documented HEADLACE backdoor. The implant was refined over time to evade sandbox environments and adapt to webhook service limitations. The group employed a tiered operational model, using second-stage payloads with shorter beaconing intervals for high-value targets to maintain stealth and operational efficiency.

The espionage campaigns enabled BlueDelta to gain persistent access to sensitive government and diplomatic networks in multiple countries, facilitating data exfiltration and intelligence gathering. The use of a lightweight backdoor that abuses legitimate webhook services complicates detection and mitigation efforts. The tiered deployment model increases the risk to high-value targets by increasing the frequency of communication with command-and-control infrastructure, potentially leading to more effective data theft.

No official patch or remediation is indicated for this threat as it involves malware deployment via social engineering and macro-enabled documents. Organizations should apply best practices for handling macro-enabled documents, including disabling macros by default and training users to recognize phishing lures. Monitoring for unusual webhook service usage and network traffic patterns may help detect HOOKEDGE activity. Since this is a targeted espionage campaign, tailored threat hunting and incident response are recommended. No vendor advisory or patch information is available; therefore, patch status is not applicable.