Regions Targeted: Romania, Spain, Turkey, Europe
Related Malware: HEADLACE
Key Takeaways
Background
BlueDelta’s deployment of HOOKEDGE represents an evolution of the threat actor’s established initial-access tradecraft rather than a significant expansion of capability. HOOKEDGE shares substantial architectural and code similarities with the group’s previously documented HEADLACE backdoor, including Windows batch-based execution, abuse of legitimate internet services (LIS), and browser-mediated C2 communications. The campaign is notable for BlueDelta’s deliberate use of legitimate services and native software to reduce anomalous network activity. HOOKEDGE routes command retrieval and data exfiltration through webhook[.]site using Microsoft Edge, allowing malicious communications to resemble legitimate HTTPS browser traffic.
BlueDelta also appears to use a tiered operational model. Initial HOOKEDGE infections provide low-noise access and telemetry that can help operators identify successful compromises. Targets assessed as having higher intelligence value can subsequently receive a second HOOKEDGE instance configured for significantly more frequent communication, enabling more responsive operator tasking and intelligence collection.
Technical Analysis
Recorded Future identified BlueDelta initial-access campaigns conducted between late September 2025 and early April 2026 targeting organizations in Romania, Spain, and Turkey. Additional HOOKEDGE variants observed in June and July 2026 demonstrate continued refinement of the malware and associated delivery tradecraft.
Early campaigns used diplomatic-themed Microsoft Word documents. The earliest identified lure impersonated material from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes and was created shortly after a September 2025 meeting between Spanish and Moldovan officials. The timing potentially indicates an effort to exploit diplomatic activity relevant to Russian intelligence requirements ahead of Moldova’s September 2025 parliamentary elections. However, the specific intelligence objective has not been confirmed.
Between October and December 2025, BlueDelta shifted toward generic social-engineering documents containing junk content or instructions to select “Enable Content.” Enabling macros initiated the infection chain while displaying a fake Microsoft Word error message intended to discourage further scrutiny. BlueDelta also incorporated remote canaries into portions of its phishing operations. Observed requests using filenames including mailopened.jpg, docopened.jpg, and doc.jpg provided operators with telemetry that could distinguish between email opens, document opens, and later stages of successful execution. The document-open canary was removed from samples observed in July 2026.
HOOKEDGE Infection Chain
HOOKEDGE is primarily delivered through macro-enabled Microsoft Word documents likely distributed via spearphishing attachments. Execution requires the recipient to enable the embedded macros. Once activated, the document’s AutoOpen() routine writes six files to the victim’s %userprofile% directory and launches a multi-stage installer chain. These files include batch, command, VBScript, HTML, and XHTML components supporting execution, persistence, and exfiltration. The installer establishes persistence through a Windows scheduled task that periodically launches the HOOKEDGE backdoor. Installation components subsequently delete themselves and associated artifacts, reducing the forensic footprint of the initial compromise. HOOKEDGE then operates as a polling backdoor.
During an execution cycle, the malware:
Using separate webhook endpoints for tasking and exfiltration compartmentalizes these functions while allowing BlueDelta to avoid maintaining dedicated attacker-controlled C2 infrastructure.
Tiered Victim Tasking
BlueDelta used HOOKEDGE as both an initial-access mechanism and a delivery method for additional HOOKEDGE payloads configured for more intensive tasking. One documented first-stage configuration used a scheduled task executing every 30 minutes. Second-stage HOOKEDGE instances deployed against selected victims could beacon as frequently as every five minutes, allowing operators to issue commands and receive results more rapidly.
Recorded Future assesses with moderate confidence that deploying a second HOOKEDGE payload represents a deliberate victim-triage mechanism. Operators likely use network telemetry, including document-open canaries and successful staging or exfiltration communications, to identify compromises warranting more intensive collection.
The architecture also addresses infrastructure limitations associated with webhook[.]site. The service’s free tier allows a maximum of 100 requests per unique endpoint. Moving higher-priority victims to dedicated endpoints separates initial-access infrastructure from active collection infrastructure and prevents intensive tasking from prematurely exhausting initial-access endpoints.
Evasion and Infrastructure
BlueDelta relied exclusively on webhook[.]site for C2, payload staging, and data exfiltration across the campaigns documented by Recorded Future. The legitimate service provides attacker-controlled HTTPS endpoints without requiring BlueDelta to operate dedicated C2 infrastructure.
HOOKEDGE further disguises communications by using msedge.exe as the HTTP client. Earlier variants executed Edge in headless mode, while later versions used hidden browser windows. As a result, malicious network activity originates from a legitimate browser process communicating with a legitimate HTTPS service, reducing the effectiveness of defenses based primarily on domain or IP reputation. BlueDelta administered observed webhook[.]site endpoints from NordVPN IP addresses, further obscuring operator infrastructure.
The group continued modifying HOOKEDGE throughout the observed period. Changes included modifications to lure documents and VBA obfuscation, transitions from headless to hidden Edge execution, introduction and later removal of document-open canaries, and adjustments to beaconing intervals.
Recorded Future identified a later first-stage configuration using a 61-minute beaconing interval. They assessed that this change likely both reduced consumption of the finite requests available through webhook[.]site and reduced the effectiveness of automated sandbox environments that monitor execution for up to approximately 60 minutes.
Targeting
Observed HOOKEDGE activity targeted organizations associated with government, diplomacy, and defense manufacturing in Romania, Spain, and Turkey. The diplomatic nature of the initial lure material and its timing indicate collection priorities consistent with Russian interest in European governance, Moldovan political affairs, and NATO-adjacent diplomatic activity. Recorded Future assesses with medium confidence that the broader targeting pattern reflects active Russian intelligence collection against European diplomatic targets, particularly organizations involved in or adjacent to Moldovan political affairs and broader NATO-adjacent European governance.
Who is BlueDelta?
BlueDelta is a Russian state-sponsored cyberespionage group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). BlueDelta overlaps with activity publicly tracked as APT28, Fancy Bear, and Forest Blizzard.
The group has conducted espionage-focused cyber operations for more than a decade, consistently targeting government, diplomatic, defense, and policy-related organizations in support of Russian intelligence requirements. BlueDelta commonly relies on spearphishing, credential theft, malicious documents, living-off-the-land techniques, and lightweight custom tooling to establish and maintain access.
Recorded Future’s Insikt Group assesses with moderate confidence that the HOOKEDGE activity was conducted by BlueDelta. The assessment is based on significant code and tradecraft overlap between HOOKEDGE and HEADLACE, consistent infrastructure patterns, and targeting aligned with known Russian intelligence collection priorities. They also assess with moderate confidence that HOOKEDGE is a direct evolutionary successor to HEADLACE developed and maintained by the same operators. Both backdoors use Windows batch scripting, legitimate internet services for C2 and exfiltration, and hidden browser instances for C2 communications. Second-stage payloads retrieved by HOOKEDGE also share JavaScript code, variable names, properties, structure, and base64 encoding schemes with payloads previously observed in HEADLACE campaigns.
Analyst Commentary
HOOKEDGE demonstrates that sophisticated state-sponsored cyberespionage operations do not necessarily require sophisticated malware. BlueDelta combines relatively simple Windows scripting with legitimate browser execution and trusted third-party infrastructure to create an adaptable initial-access platform with a limited network footprint. This approach increases the importance of identifying malicious files and behaviors before attackers can establish persistent access.
The campaign also highlights the defensive challenge created by legitimate internet service abuse. Individual webhook[.]siteURLs are inexpensive and easily replaced, limiting the long-term value of static endpoint blocking. BlueDelta has previously migrated between legitimate services, indicating that disruption of one platform would likely cause the group to adopt another rather than transition to dedicated attacker-controlled infrastructure. Defenders should therefore prioritize malware intelligence and behavioral relationships that remain useful as attacker infrastructure changes.
BlueDelta will likely continue modifying or eventually replacing HOOKEDGE as defensive coverage improves. However, continuity between HEADLACE and HOOKEDGE suggests that future tooling may retain recognizable characteristics, including lightweight scripting, legitimate service abuse, browser-mediated communications, GUID-formatted artifacts, and LotL execution.
PolySwarm can help organizations identify and investigate threats such as HOOKEDGE by analyzing suspicious files and URLs across a diverse network of independent detection engines rather than relying on a single vendor’s visibility. Multi-engine verdicts and PolyScore consensus scoring can provide analysts with additional context when triaging suspicious attachments, while PolySwarm’s sandboxing can expose execution artifacts, network activity, dropped payloads, and other behaviors associated with emerging malware.
IOCs
PolySwarm has multiple samples associated with this activity.
206bd177f3f3b637b0a444ce2dd6d5aaaefc9d66c866ac6ec0c9e946ce140991
231164362b2e4688e5d64ef7154845d655b649470bf995a79107b800ac5663b1
58cfb8b9fee1caa94813c259901dc1baa96bae7d30d79b79a7d441d0ee4e577e
5f2a06bb1d1a210e9c477e4e5db439ce7b11fe9345d39b1b959905ba576a076a
87c15e4cf30098dcbfe9fd506c42896bf6d856aa77a70f312dd621b443b61dc3
9097d9cf5e6659e869bf2edf766741b687e3d8570036d853c0ca59ae72f9e9fc
aebf896b2f60c52af5d38c036159e0243632134643e8ad374cb64ed8cb09f360
b0f9f0a34ccab1337fbcca24b4f894de8d6d3a6f5db2e0463e2320215e4262e4
c2c9187033d22d7944ea9298461a0ac693ef2774b4ce08b0955d2aba3646fb44
df60fa6008b1a0b79c394b42d3ada6bab18b798f3c2ca1530a3e0cb4fbbbe9f6
ed8f20bbab18b39a67e4db9a03090e5af8dc8ec24fe1ddf3521b3f340a8318c1
f611e5415e21f229f75a42011d092e781ffe4118bb70ac95b9d85c41c81ef6ca
Click here to view all samples of HOOKEDGE in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.