Insikt Group identified BlueDelta initial access campaigns from late September 2025 to early April 2026 that targeted government and diplomatic organizations in Romania, Spain, and Türkiye using macro-enabled Word documents to deliver the HOOKEDGE backdoor. HOOKEDGE relies on webhook[.]site, Microsoft Edge, scheduled tasks, and staged batch-script execution, and the activity overlaps heavily with the earlier HEADLACE malware and the BlueDelta cluster associated with APT28, Fancy Bear, and Forest Blizzard. #BlueDelta #HOOKEDGE #HEADLACE #APT28 #FancyBear #ForestBlizzard #webhooksite
Keypoints
- BlueDelta ran a series of initial access campaigns between late September 2025 and early April 2026.
- Targets included government, diplomatic, and defense-related organizations in Romania, Spain, and Türkiye.
- The group delivered HOOKEDGE through macro-enabled Microsoft Word documents, often using diplomatic-themed lures.
- HOOKEDGE is a lightweight Windows batch backdoor that uses scheduled tasks and Microsoft Edge for tasking and exfiltration.
- The malware and tradecraft strongly overlap with HEADLACE, suggesting HOOKEDGE is an evolutionary successor.
- BlueDelta consistently abused webhook[.]site for C2, payload staging, canarying, and exfiltration.
- Operators refined lure content, beacon intervals, and execution methods over time to improve resilience and evade detection.
MITRE Techniques
- [T1583.006 ] Web Services – BlueDelta used webhook[.]site as legitimate infrastructure for C2, staging, canaries, and exfiltration. (‘abusing legitimate webhook services for command-and-control (C2), payload staging, and data exfiltration’)
- [T1059.003 ] Windows Command Shell – HOOKEDGE used .cmd payloads and Windows batch execution for command running and persistence. (‘retrieving arbitrary .cmd payloads from a staging webhook, executing them on the infected host’)
- [T1059.005 ] Visual Basic – Malicious Word documents used VBA macros to trigger the infection chain. (‘When a recipient opens a lure document and enables macros, the document’s AutoOpen() subroutine executes immediately’)
- [T1204.002 ] Malicious File – Victims had to open malicious macro-enabled Word documents to initiate execution. (‘macro-enabled Microsoft Word documents, likely delivered via spearphishing attachments, as the primary delivery mechanism’)
- [T1053.005 ] Scheduled Task – The installer created scheduled tasks to run HOOKEDGE repeatedly for persistence. (‘it creates a scheduled task that runs every 30 minutes’)
- [T1027.013 ] Encrypt/Encode File – HOOKEDGE used encoded/structured web content and base64 schemes in payload delivery. (‘using identical variable names, properties, structure, and base64 encoding schemes’)
- [T1070.004 ] File Deletion – The installer deleted itself and other artifacts to reduce forensic traces. (‘the installer then deletes itself, the installer launcher, and the task definition file’)
- [T1140 ] Deobfuscate/Decode Files or Information – The malware concatenated staged files and reconstructed commands before execution. (‘Concatenates all retrieved .75e files into a .cmd file’)
- [T1083 ] File and Directory Discovery – HOOKEDGE removed and checked residual files in user-writable paths during execution. (‘Deletes residual files from the %userprofile%Downloads directory’)
- [T1074.001 ] Local Data Staging – The malware assembled HTML output locally before exfiltration. (‘Assembles an HTML exfiltration file by wrapping the command output’)
- [T1071.001 ] Web Protocols – Commanding and exfiltration occurred through HTTP/HTTPS traffic via web services and browsers. (‘issues a Microsoft Edge request to the staging webhook URL’)
- [T1105 ] Ingress Tool Transfer – HOOKEDGE retrieved command payloads from remote webhooks to the victim host. (‘retrieving arbitrary .cmd payloads from a staging webhook’)
- [T1041 ] Exfiltration Over C2 Channel – Command output was sent back over the same operational channel used for tasking. (‘exfiltrates the output to a separate exfiltration webhook’)
- [T1567.004 ] Exfiltration Over Webhook – Output was posted to webhook endpoints after browser-based form submission. (‘makes an HTTP POST request of the command output to the exfiltration webhook’)
Indicators of Compromise
- [URLs ] webhook endpoints used for canaries, staging, and exfiltration – hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg, hxxp://webhook[.]site/c29905ab-e5fa-446c-8958-4eab15d8fb80/mailopened[.]jpg, and other webhook[.]site URLs
- [Hashes ] sample and payload hashes associated with HOOKEDGE-related components – 001b57368c10bee9e62374e3b3f232b113eb75a1f198243d43a5bb90e1d0f500, 206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991, and 25 more hashes
- [File Names ] dropped installer, launcher, and staging files used in the infection chain – cf25f91c-0a20-4339-834f-02f73e8bc75e.bat, cf25f91c-0a20-4339-834f-02f73e8bc75e.vbs, and cf25f91c-0a20-4339-834f-02f73e8bc75e.htm
- [File Names ] canary and lure-related filenames used to track document/email opens – docopened.jpg, mailopened.jpg, and doc.jpg
- [System/User Paths ] payload staging and execution locations on victims – %userprofile%, %userprofile%Downloads, and temporary files in %userprofile%
Read more: https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge