APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

APT28-linked threat actors, tracked as BlueDelta, have been deploying a new backdoor named HOOKEDGE to target European government and diplomatic organizations since late 2025. HOOKEDGE, a lightweight Windows batch script, is delivered via macro-enabled Word documents and utilizes webhook[.]site for command-and-control, data exfiltration, and to bypass infrastructure limitations. The group has refined this tool over the past year, adapting it to evade detection and maintain operational resilience against evolving defenses. This represents a continued effort by APT28 to gather intelligence from European government and diplomatic targets.