APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Summary: Recorded Future attributed with moderate confidence to APT28 a set of campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026, delivering a new Windows batch backdoor called HOOKEDGE through macro-enabled Word documents with diplomatic-themed lures. HOOKEDGE is a successor to the HEADLACE backdoor, uses webhook[.]site for command-and-control, payload staging, and exfiltration, and runs from a scheduled task every 30 minutes while deleting its installer files to reduce forensic traces.
Why it matters: The group moved high-value victims to a second-stage payload beaconing as often as every five minutes, because webhook[.]site's free tier caps an endpoint at 100 requests and a 30-minute interval would exhaust it in roughly two to three days. That means the attackers are triaging which European government and diplomatic victims are worth deeper collection, and the tooling is a batch script hiding in headless Edge traffic your controls may not inspect.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026