# HOOKEDGE: New BlueDelta (APT28/Fancy Bear) Backdoor Abuses Microsoft Edge and webhook.site for C2

> BlueDelta (overlapping APT28/Fancy Bear/Forest Blizzard, GRU Unit 26165) deployed a new lightweight Windows batch-script backdoor, HOOKEDGE, against defense manufacturers, government bodies, and diplomatic organizations in Romania, Spain, and Turkiye. HOOKEDGE is delivered via macro-enabled Word spearphishing lures and routes tasking and exfiltration through the free webhook.site service via hidden/headless Microsoft Edge browser sessions, evolving directly from the group's earlier HEADLACE backdoor.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2187
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-hookedge-webhook-site-and-edge-tl-2026-2187.webp?v=f7a3ceef (Threadlinqs threat intel: Fancy Bear's HOOKEDGE Backdoor: Detection & IOCs (TL-2026-2187) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2187
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

Recorded Future's Insikt Group documented an espionage campaign, active from late September 2025 through at least June 2026, run by BlueDelta -- a Russian GRU-linked group tracked with moderate confidence as supporting Russian intelligence collection, and publicly overlapping with APT28, Fancy Bear, and Forest Blizzard. The operation targets defense manufacturers, government ministries, and diplomatic organizations in Romania, Spain, and Turkiye, with lure content and timing (e.g., a document impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, built around a September 2025 Spain-Moldova meeting) indicating a focus on Moldovan political affairs and NATO-adjacent European governance.

Initial access is via spearphishing email carrying macro-enabled Word documents. An AutoOpen() VBA macro drops several GUID-named files into %userprofile% (a .bat backdoor, a .vbs launcher, a .cmd installer, and .htm/.xhtml exfiltration-staging templates), launches an installer, and establishes persistence via a Windows Scheduled Task before deleting its own installation traces. A hidden tracking-pixel field (INCLUDEPICTURE, per the related Lab52 'Operation MacroMaze' reporting) pointing at a dedicated webhook.site JPG endpoint (docopened.jpg / mailopened.jpg / later doc.jpg) alerts the operators when a lure email or document is opened, functioning as phishing-campaign telemetry independent of the backdoor itself.

HOOKEDGE itself is a lightweight batch-script backdoor with no compiled binary component. On each beacon cycle it: (1) clears residual download artifacts, (2) issues an outbound request from msedge.exe (headless in early samples, later a hidden window) to a dedicated 'staging' webhook.site endpoint that returns HTML/JavaScript which auto-downloads command fragments, (3) concatenates the fragments into a .cmd payload and executes it, capturing output, (4) wraps the output in the pre-staged .htm/.xhtml template and launches a second Edge instance to auto-submit an HTML form that POSTs the results to a separate 'exfiltration' webhook.site endpoint, and (5) deletes its temporary artifacts and terminates its own process before the next cycle. Using msedge.exe for all C2/exfil traffic blends the beacon activity into ordinary enterprise browsing and defeats reputation- and TLS-inspection controls that would otherwise flag a raw HTTPS client.

BlueDelta runs a two-tier tasking model: a broad first-stage implant beacons roughly every 30-61 minutes (the interval was deliberately extended to 61 minutes in the campaign to outlast the ~1-hour observation window of many automated sandboxes), while victims triaged as high-value receive a dedicated second-stage HOOKEDGE instance with its own webhook endpoints checking in as often as every 5 minutes. Splitting endpoints by function (email-open canary, document-open canary, command staging, payload staging, exfiltration capture) also works around webhook.site's 100-request-per-endpoint free-tier cap, letting the operators provision fresh, disposable infrastructure cheaply while preserving quota on higher-value channels. Recorded Future further observed NordVPN IPs used to administer the webhook.site endpoints.

HOOKEDGE shares deep code and structural lineage with BlueDelta's earlier HEADLACE backdoor (deployed April-December 2023 against Ukrainian defense/government targets and European rail infrastructure, itself abusing the Mocky.io mocking service for C2), including identical JavaScript variable names and the same base64 payload-encoding scheme -- indicating iterative refinement of a consistent, disposable, 'living-off-trusted-services' toolset rather than a wholesale retooling. Independent reporting from Lab52 (S2 Grupo), tracking overlapping activity as 'Operation MacroMaze,' corroborates the webhook.site-based macro/dropper chain against the same target set. No CVE is associated with this campaign -- it relies entirely on social engineering (macro enablement) and abuse of legitimate, trusted software (Word, Edge) and services (webhook.site), not a software vulnerability.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1583.006 Web Services
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1027.013 Encrypted/Encoded File
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1567.004 Exfiltration Over Webhook

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**HOOKEDGE Spearphishing Macro Dropping Script Files and Beaconing Tracking Pixel** (`TL-2026-2187-SPL-001`)

Detects the HOOKEDGE initial-access chain: a macro-enabled Word document's AutoOpen() VBA macro spawning wscript.exe/cscript.exe/cmd.exe from WINWORD.EXE, dropping GUID-named .bat/.vbs/.cmd/.htm/.xhtml files into %USERPROFILE%, and/or an INCLUDEPICTURE tracking-pixel field resolving to a webhook.site canary endpoint (docopened.jpg/mailopened.jpg/doc.jpg) that alerts BlueDelta operators when the lure email or document is opened.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1059.005, T1059.003, T1583.006
- **Data sources:** sysmon, windows_security, dns_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=1 ParentImage="*\\WINWORD.EXE" Image IN ("*\\wscript.exe","*\\cscript.exe","*\\cmd.exe"))
OR (EventCode=11 TargetFilename="*\\Users\\*" TargetFilename="*-*-*-*-*.*" TargetFilename IN ("*.bat","*.vbs","*.cmd","*.htm","*.xhtml"))
OR (EventCode=22 QueryName="webhook.site")
| eval detection_stage=case(EventCode=1,"script_interpreter_spawn",EventCode=11,"guid_payload_drop",EventCode=22,"canary_dns_resolution")
| stats earliest(_time) as first_seen latest(_time) as last_seen values(detection_stage) as stages values(Image) as spawned_image values(TargetFilename) as dropped_file dc(detection_stage) as distinct_stages by ComputerName, User
| where distinct_stages >= 1
| table ComputerName, User, first_seen, last_seen, stages, spawned_image, dropped_file
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in~ ("wscript.exe","cscript.exe","cmd.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has @"\Users\"
    | where FileName matches regex @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.(bat|vbs|cmd|htm|xhtml)$"
    | project Timestamp, DeviceName, AccountName = RequestAccountName, FileName, FolderPath
)
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName =~ "WINWORD.EXE"
    | where RemoteUrl has "webhook.site" and RemoteUrl matches regex @"(docopened|mailopened|doc)\.jpg$"
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl
)
```

### Sigma

```yaml
title: Microsoft Word Spawning Script Interpreter with Dropped GUID-Named Payloads (HOOKEDGE Initial Access)
id: 7a1e9c4d-3b6f-4e2a-9d51-8f6c2e1a0b3d
status: experimental
description: Detects a Microsoft Word process spawning a script interpreter (wscript.exe, cscript.exe, cmd.exe) consistent with an AutoOpen() VBA macro executing a dropped installer, as used by the BlueDelta HOOKEDGE backdoor to stage its .bat/.vbs/.cmd/.htm/.xhtml payload set under %USERPROFILE%.
references:
    - https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge
    - https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.005
    - attack.t1059.003
    - attack.resource-development
    - attack.t1583.006
    - attack.group.g0007
    - attack.tool.hookedge
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\WINWORD.EXE'
    selection_child:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate document-automation macros that intentionally invoke Windows Script Host in change-controlled environments
level: high
```

**Known false positives:**

- Legitimate mail-merge or template-based Word documents that use INCLUDEPICTURE fields for internal branding pixels
- Administrative scripts intentionally launched from macros in change-controlled document-automation environments

**Tuning notes:** Scope ParentImage to WINWORD.EXE/EXCEL.EXE and require the source document carry Mark-of-the-Web before alerting; exclude signed internal document-generation service accounts and known mail-merge templates.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- HOOKEDGE Spearphishing Macro Dropping Script Files and Beaconing Tracking Pixel (locked: unlock with TL Creds)
- HOOKEDGE Scheduled Task Persistence with Self-Deletion and Artifact Cleanup (locked: unlock with TL Creds)
- Hidden/Headless Microsoft Edge C2 Beaconing and HTML Form Exfiltration to [indicator] (locked: unlock with TL Creds)
- HOOKEDGE Spearphishing Macro Dropping Script Files and Beaconing Tracking Pixel (locked: unlock with TL Creds)
- HOOKEDGE Scheduled Task Persistence with Self-Deletion and Artifact Cleanup (locked: unlock with TL Creds)
- Hidden/Headless Microsoft Edge C2 Beaconing and HTML Form Exfiltration to [indicator] (locked: unlock with TL Creds)
- HOOKEDGE Scheduled Task Persistence with Self-Deletion and Artifact Cleanup (locked: unlock with TL Creds)
- Hidden/Headless Microsoft Edge C2 Beaconing and HTML Form Exfiltration to [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- File hash: `001b57368c10bee9e62374e3b3f232b113eb75a1f198243d43a5bb90e1d0f500`
- File hash: `206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991`
- File hash: `9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Use New HOOKEDGE Malware](https://cybersecuritynews.com/hackers-use-new-hookedge-malware/)
- [BlueDelta Targets Defense and Diplomacy with HOOKEDGE](https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge)
- [Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations](https://securityaffairs.com/197996/apt/russian-apt-bluedelta-uses-hookedge-to-target-defense-and-diplomatic-organizations.html)
- [BlueDelta Targets Defense and Diplomatic Organizations With HOOKEDGE Malware](https://gbhackers.com/hookedge-malware-campaign/)
- [Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure](https://lab52.io/blog/operation-macromaze-new-apt28-campaign-using-basic-tooling-and-legit-infrastructure/)
- [APT28 Targeted European Entities Using Webhook-Based Macro Malware](https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html)
- [Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting](https://thehackernews.com/2024/05/russian-hackers-target-europe-with.html)
- [APT28, Fancy Bear, Forest Blizzard, Group G0007](https://attack.mitre.org/groups/G0007/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2187