Recorded Future's Insikt Group documented an espionage campaign, active from late September 2025 through at least June 2026, run by BlueDelta -- a Russian GRU-linked group tracked with moderate confidence as supporting Russian intelligence collection, and publicly overlapping with APT28, Fancy Bear, and Forest Blizzard. The operation targets defense manufacturers, government ministries, and diplomatic organizations in Romania, Spain, and Turkiye, with lure content and timing (e.g., a document impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, built around a September 2025 Spain-Moldova meeting) indicating a focus on Moldovan political affairs and NATO-adjacent European governance.

Initial access is via spearphishing email carrying macro-enabled Word documents. An AutoOpen() VBA macro drops several GUID-named files into %userprofile% (a .bat backdoor, a .vbs launcher, a .cmd installer, and .htm/.xhtml exfiltration-staging templates), launches an installer, and establishes persistence via a Windows Scheduled Task before deleting its own installation traces. A hidden tracking-pixel field (INCLUDEPICTURE, per the related Lab52 'Operation MacroMaze' reporting) pointing at a dedicated webhook.site JPG endpoint (docopened.jpg / mailopened.jpg / later doc.jpg) alerts the operators when a lure email or document is opened, functioning as phishing-campaign telemetry independent of the backdoor itself.

HOOKEDGE itself is a lightweight batch-script backdoor with no compiled binary component. On each beacon cycle it: (1) clears residual download artifacts, (2) issues an outbound request from msedge.exe (headless in early samples, later a hidden window) to a dedicated 'staging' webhook.site endpoint that returns HTML/JavaScript which auto-downloads command fragments, (3) concatenates the fragments into a .cmd payload and executes it, capturing output, (4) wraps the output in the pre-staged .htm/.xhtml template and launches a second Edge instance to auto-submit an HTML form that POSTs the results to a separate 'exfiltration' webhook.site endpoint, and (5) deletes its temporary artifacts and terminates its own process before the next cycle. Using msedge.exe for all C2/exfil traffic blends the beacon activity into ordinary enterprise browsing and defeats reputation- and TLS-inspection controls that would otherwise flag a raw HTTPS client.

BlueDelta runs a two-tier tasking model: a broad first-stage implant beacons roughly every 30-61 minutes (the interval was deliberately extended to 61 minutes in the campaign to outlast the ~1-hour observation window of many automated sandboxes), while victims triaged as high-value receive a dedicated second-stage HOOKEDGE instance with its own webhook endpoints checking in as often as every 5 minutes. Splitting endpoints by function (email-open canary, document-open canary, command staging, payload staging, exfiltration capture) also works around webhook.site's 100-request-per-endpoint free-tier cap, letting the operators provision fresh, disposable infrastructure cheaply while preserving quota on higher-value channels. Recorded Future further observed NordVPN IPs used to administer the webhook.site endpoints.

HOOKEDGE shares deep code and structural lineage with BlueDelta's earlier HEADLACE backdoor (deployed April-December 2023 against Ukrainian defense/government targets and European rail infrastructure, itself abusing the Mocky.io mocking service for C2), including identical JavaScript variable names and the same base64 payload-encoding scheme -- indicating iterative refinement of a consistent, disposable, 'living-off-trusted-services' toolset rather than a wholesale retooling. Independent reporting from Lab52 (S2 Grupo), tracking overlapping activity as 'Operation MacroMaze,' corroborates the webhook.site-based macro/dropper chain against the same target set. No CVE is associated with this campaign -- it relies entirely on social engineering (macro enablement) and abuse of legitimate, trusted software (Word, Edge) and services (webhook.site), not a software vulnerability.