HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2

Key facts for HOOKEDGE webhook.site and Edge

Detection coverage for HOOKEDGE webhook.site and Edge

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2187 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: HOOKEDGE Spearphishing Macro Dropping Script Files and Beaconing Tracking Pixel

Detects the HOOKEDGE initial-access chain: a macro-enabled Word document's AutoOpen() VBA macro spawning wscript.exe/cscript.exe/cmd.exe from WINWORD.EXE, dropping GUID-named .bat/.vbs/.cmd/.htm/.xhtml files into %USERPROFILE%, and/or an INCLUDEPICTURE tracking-pixel field resolving to a webhook.site canary endpoint (docopened.jpg/mailopened.jpg/doc.jpg) that alerts BlueDelta operators when the lure email or document is opened.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1059.005, T1059.003, T1583.006
• Data sources: sysmon, windows_security, dns_logs
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=1 ParentImage="*\\WINWORD.EXE" Image IN ("*\\wscript.exe","*\\cscript.exe","*\\cmd.exe"))
OR (EventCode=11 TargetFilename="*\\Users\\*" TargetFilename="*-*-*-*-*.*" TargetFilename IN ("*.bat","*.vbs","*.cmd","*.htm","*.xhtml"))
OR (EventCode=22 QueryName="webhook.site")
| eval detection_stage=case(EventCode=1,"script_interpreter_spawn",EventCode=11,"guid_payload_drop",EventCode=22,"canary_dns_resolution")
| stats earliest(_time) as first_seen latest(_time) as last_seen values(detection_stage) as stages values(Image) as spawned_image values(TargetFilename) as dropped_file dc(detection_stage) as distinct_stages by ComputerName, User
| where distinct_stages >= 1
| table ComputerName, User, first_seen, last_seen, stages, spawned_image, dropped_file

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in~ ("wscript.exe","cscript.exe","cmd.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has @"\Users\"
    | where FileName matches regex @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.(bat|vbs|cmd|htm|xhtml)$"
    | project Timestamp, DeviceName, AccountName = RequestAccountName, FileName, FolderPath
)
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName =~ "WINWORD.EXE"
    | where RemoteUrl has "webhook.site" and RemoteUrl matches regex @"(docopened|mailopened|doc)\.jpg$"
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl
)

Sigma

title: Microsoft Word Spawning Script Interpreter with Dropped GUID-Named Payloads (HOOKEDGE Initial Access)
id: 7a1e9c4d-3b6f-4e2a-9d51-8f6c2e1a0b3d
status: experimental
description: Detects a Microsoft Word process spawning a script interpreter (wscript.exe, cscript.exe, cmd.exe) consistent with an AutoOpen() VBA macro executing a dropped installer, as used by the BlueDelta HOOKEDGE backdoor to stage its .bat/.vbs/.cmd/.htm/.xhtml payload set under %USERPROFILE%.
references:
    - https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge
    - https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.005
    - attack.t1059.003
    - attack.resource-development
    - attack.t1583.006
    - attack.group.g0007
    - attack.tool.hookedge
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\WINWORD.EXE'
    selection_child:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate document-automation macros that intentionally invoke Windows Script Host in change-controlled environments
level: high

Known false positives:

• Legitimate mail-merge or template-based Word documents that use INCLUDEPICTURE fields for internal branding pixels
• Administrative scripts intentionally launched from macros in change-controlled document-automation environments

Tuning notes: Scope ParentImage to WINWORD.EXE/EXCEL.EXE and require the source document carry Mark-of-the-Web before alerting; exclude signed internal document-generation service accounts and known mail-merge templates.

• 🔒 HOOKEDGE Spearphishing Macro Dropping Script Files and Beaconing Tracking Pixel · unlock with TL Creds
• 🔒 HOOKEDGE Scheduled Task Persistence with Self-Deletion and Artifact Cleanup · unlock with TL Creds
• 🔒 Hidden/Headless Microsoft Edge C2 Beaconing and HTML Form Exfiltration to [indicator] · unlock with TL Creds
• 🔒 HOOKEDGE Spearphishing Macro Dropping Script Files and Beaconing Tracking Pixel · unlock with TL Creds
• 🔒 HOOKEDGE Scheduled Task Persistence with Self-Deletion and Artifact Cleanup · unlock with TL Creds
• 🔒 Hidden/Headless Microsoft Edge C2 Beaconing and HTML Form Exfiltration to [indicator] · unlock with TL Creds
• 🔒 HOOKEDGE Scheduled Task Persistence with Self-Deletion and Artifact Cleanup · unlock with TL Creds
• 🔒 Hidden/Headless Microsoft Edge C2 Beaconing and HTML Form Exfiltration to [indicator] · unlock with TL Creds

Indicators of compromise for HOOKEDGE webhook.site and Edge

As of 2026-08-28, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2187.

Sample indicators (3 of 24)

• File hash: 001b57368c10bee9e62374e3b3f232b113eb75a1f198243d43a5bb90e1d0f500
• File hash: 206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991
• File hash: 9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How HOOKEDGE webhook.site and Edge works

Recorded Future's Insikt Group documented an espionage campaign, active from late September 2025 through at least June 2026, run by BlueDelta -- a Russian GRU-linked group tracked with moderate confidence as supporting Russian intelligence collection, and publicly overlapping with APT28, Fancy Bear, and Forest Blizzard. The operation targets defense manufacturers, government ministries, and diplomatic organizations in Romania, Spain, and Turkiye, with lure content and timing (e.g., a document impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, built around a September 2025 Spain-Moldova meeting) indicating a focus on Moldovan political affairs and NATO-adjacent European governance.

Initial access is via spearphishing email carrying macro-enabled Word documents. An AutoOpen() VBA macro drops several GUID-named files into %userprofile% (a .bat backdoor, a .vbs launcher, a .cmd installer, and .htm/.xhtml exfiltration-staging templates), launches an installer, and establishes persistence via a Windows Scheduled Task before deleting its own installation traces. A hidden tracking-pixel field (INCLUDEPICTURE, per the related Lab52 'Operation MacroMaze' reporting) pointing at a dedicated webhook.site JPG endpoint (docopened.jpg / mailopened.jpg / later doc.jpg) alerts the operators when a lure email or document is opened, functioning as phishing-campaign telemetry independent of the backdoor itself.

HOOKEDGE itself is a lightweight batch-script backdoor with no compiled binary component. On each beacon cycle it: (1) clears residual download artifacts, (2) issues an outbound request from msedge.exe (headless in early samples, later a hidden window) to a dedicated 'staging' webhook.site endpoint that returns HTML/JavaScript which auto-downloads command fragments, (3) concatenates the fragments into a .cmd payload and executes it, capturing output, (4) wraps the output in the pre-staged .htm/.xhtml template and launches a second Edge instance to auto-submit an HTML form that POSTs the results to a separate 'exfiltration' webhook.site endpoint, and (5) deletes its temporary artifacts and terminates its own process before the next cycle. Using msedge.exe for all C2/exfil traffic blends the beacon activity into ordinary enterprise browsing and defeats reputation- and TLS-inspection controls that would otherwise flag a raw HTTPS client.

BlueDelta runs a two-tier tasking model: a broad first-stage implant beacons roughly every 30-61 minutes (the interval was deliberately extended to 61 minutes in the campaign to outlast the ~1-hour observation window of many automated sandboxes), while victims triaged as high-value receive a dedicated second-stage HOOKEDGE instance with its own webhook endpoints checking in as often as every 5 minutes. Splitting endpoints by function (email-open canary, document-open canary, command staging, payload staging, exfiltration capture) also works around webhook.site's 100-request-per-endpoint free-tier cap, letting the operators provision fresh, disposable infrastructure cheaply while preserving quota on higher-value channels. Recorded Future further observed NordVPN IPs used to administer the webhook.site endpoints.

HOOKEDGE shares deep code and structural lineage with BlueDelta's earlier HEADLACE backdoor (deployed April-December 2023 against Ukrainian defense/government targets and European rail infrastructure, itself abusing the Mocky.io mocking service for C2), including identical JavaScript variable names and the same base64 payload-encoding scheme -- indicating iterative refinement of a consistent, disposable, 'living-off-trusted-services' toolset rather than a wholesale retooling. Independent reporting from Lab52 (S2 Grupo), tracking overlapping activity as 'Operation MacroMaze,' corroborates the webhook.site-based macro/dropper chain against the same target set. No CVE is associated with this campaign -- it relies entirely on social engineering (macro enablement) and abuse of legitimate, trusted software (Word, Edge) and services (webhook.site), not a software vulnerability.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.013 Encrypted/Encoded File; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053.005 Scheduled Task

Execution

T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols

Collection

T1074.001 Local Data Staging

Initial Access

T1566.001 Spearphishing Attachment

Exfiltration

T1567.004 Exfiltration Over Webhook

Resource Development

T1583.006 Web Services

Remediation for HOOKEDGE webhook.site and Edge

Immediate actions

• Block or tightly monitor outbound traffic to webhook.site and similar free webhook/relay services unless explicitly used organizationally
• Disable macro execution in Office documents originating from the internet (Mark-of-the-Web enforced macro block)
• Hunt for Scheduled Tasks launching scripts (.bat/.vbs/.cmd) from user-writable profile directories
• Hunt for msedge.exe launched with --headless or hidden-window arguments against local HTML files, data: URIs, or webhook.site endpoints
• Block or alert on INCLUDEPICTURE / remote-image fields in Office documents that resolve to webhook.site or similar tracking-pixel services

Workarounds

• Enforce Group Policy blocking VBA macros in documents from the internet zone
• Restrict Windows Script Host (wscript.exe/cscript.exe) execution via application control policy

Longer-term hardening

• Deploy Attack Surface Reduction rules to block Office applications from creating child processes (wscript/cscript/cmd.exe) and from launching executable content
• Implement FIDO2 / certificate-based MFA on externally accessible services to blunt any credential-harvesting follow-on activity
• Deploy EDR with behavioral detection tuned to browser-mediated C2 patterns (headless/hidden Edge sessions, auto-submitting HTML forms)
• Move toward an outbound-allowlist model for browser network egress in high-sensitivity environments (defense, government, diplomatic)

Timeline of HOOKEDGE webhook.site and Edge

• 2025-09-26 Earliest identified locked-ioc-23 lure: a macro-enabled Word document impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, built around a September 2025 Spain-Moldova meeting.
• 2025-10-07 BlueDelta shifts to generic macro-enablement lures (moving away from diplomatic-themed decoys) and adjusts first-stage beaconing interval.
• 2025-12-04 Operators switch the Edge browser process from headless mode (--headless=new) to a hidden window, likely to evade headless-browser detection heuristics.
• 2026-01-19 Further refinement of generic macro-enablement lure documents observed.
• 2026-01-20 locked-ioc-20 email-open tracking canary filename observed, extending the existing locked-ioc-21 document-open canary telemetry.
• 2026-04-08 Canary tracking-pixel filename changed to locked-ioc-24.
• 2026-06-29 VBA macro obfuscation changes introduced; the document-open canary is removed from the macro in this variant.
• 2026-08-28 Recorded Future's Insikt Group publicly discloses the locked-ioc-23 campaign and its BlueDelta/APT28 attribution; reporting syndicated by Cyber Security News, Security Affairs, and GBHackers.

Sources cited for HOOKEDGE webhook.site and Edge

• BlueDelta Targets Defense and Diplomacy with HOOKEDGE Recorded Future · Research · 2026-08-28
• Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure lab52.io · Research · 2026-02-01
• APT28, Fancy Bear, Forest Blizzard, Group G0007 MITRE · Research · 2026-08-28
• Hackers Use New HOOKEDGE Malware cybersecuritynews.com · News · 2026-08-28
• Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations securityaffairs.com · News · 2026-08-28
• BlueDelta Targets Defense and Diplomatic Organizations With HOOKEDGE Malware gbhackers.com · News · 2026-08-28
• APT28 Targeted European Entities Using Webhook-Based Macro Malware The Hacker News · News · 2026-02-01
• Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting The Hacker News · News · 2024-05-31

Threats related to HOOKEDGE webhook.site and Edge

• APT28-Linked HOOKEDGE Backdoor Targets Diplomatic and Government Organizations in Romania, Spain, and Türkiye
• BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor
• APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor
• Operation MacroMaze: APT28 Campaign Targeting Western & Central Europe via Evolving Macro Droppers & Legitimate Infrastructure Abuse

More from APT28

• APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex
• APT28 PixyNetLoader Campaign Update: PNG-steganography loader delivering Covenant Grunt against Ukrainian military logistics
• APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers to enable DNS hijacking and AitM credential theft (CVE-2023-50224) - FrostArmada / Operation Masquerade
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
• AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
• Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation Compresses Patch Timelines

Previous and next in malware

• Spark RAT Campaign Targets Cambodia via BYOVD Abuse of Vulnerable OPSWAT AppRemover Driver (CVE-2026-36425) Previous report
• TerminalFix Campaign: ClickFix-Style Lure Deploys Steganographic DLL Sideload and Custom Reverse Tunnel in Multistage Intrusion Next report