Ethical Hacking News
Russian APT BlueDelta, a group affiliated with the Russian GRU, has been using a sophisticated espionage tool called HOOKEDGE to target defense and diplomatic organizations in Europe. The tool relies on a Windows batch script and two webhooks, and uses Microsoft Edge to make the traffic look like normal web activity. This report provides an in-depth look at the HOOKEDGE tool and its use by BlueDelta, highlighting the group's ability to conduct sophisticated espionage operations in Europe and the actionable steps that defenders can take to address this threat.
Russian APT BlueDelta has been using HOOKEDGE, a sophisticated espionage tool, to target defense and diplomatic organizations in Europe. The group's use of macro-enabled Word documents as a lure is an "old-school trick" that has raised concerns about their ability to conduct sustained operations. HOOKEDGE uses a Windows batch script and two webhooks, making it a simple but effective tool for espionage. The group has shared deep code and structural overlap with HEADLACE, a backdoor used years earlier, indicating a refinement of their tradecraft. Defenders can take concrete steps to address this threat, including blocking macro execution, watching for scheduled tasks, and flagging Microsoft Edge behavior.
Russian APT BlueDelta, a group affiliated with the Russian GRU, has been using a sophisticated espionage tool called HOOKEDGE to target defense and diplomatic organizations in Europe. The group's use of HOOKEDGE, which relies on a Windows batch script and two webhooks, has raised concerns about the group's ability to conduct sustained operations in the region.
The campaign, which ran from late September 2025 to early April 2026, used a relatively old-school trick: macro-enabled Word documents. One of the documents looked like a real meeting agenda from Spain's Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova's September 2025 parliamentary elections.
The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot.
What's particularly clever about HOOKEDGE is its use of Microsoft Edge to make the traffic look like normal web activity. This is a notable aspect of the whole design. According to Recorded Future's Insikt Group, which documented the campaign, the use of msedge.exe for both tasking and exfiltration is a key evasion strategy.
The group didn't build HOOKEDGE from scratch, either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads. Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team.
The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. This two-tier setup also solved a practical infrastructure problem: webhook.site's free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation.
BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel.
For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization doesn't normally use. Even a well-configured monitoring system should be able to detect these behaviors early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block.
Conclusion
The use of HOOKEDGE by Russian APT BlueDelta highlights the group's ability to conduct sophisticated espionage operations in Europe. The group's use of a relatively old-school trick, macro-enabled Word documents, and its reliance on Microsoft Edge to make the traffic look like normal web activity, makes it harder for security tools to spot. The fact that the group shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, further emphasizes the group's ability to refine its tradecraft.
Despite the complexity of the operation, defenders have clear actionable pieces to address this threat. Blocking macro execution from documents that arrived over the internet, watching for scheduled tasks spawning script interpreters from user-writable folders, and flagging Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services that the organization doesn't normally use are all concrete steps that can be taken to detect and prevent this type of attack.
Related Information:
https://www.ethicalhackingnews.com/articles/Russian-APT-BlueDeltas-HOOKEDGE-A-Sophisticated-Espionage-Tool-with-Unusual-Evasion-Strategies-ehn.shtml
https://securityaffairs.com/197996/apt/russian-apt-bluedelta-uses-hookedge-to-target-defense-and-diplomatic-organizations.html
Published: Sat Aug 29 23:24:42 2026 by llama3.2 3B Q4_K_M
