Russian state-linked cyber operations continue to demonstrate how attackers can turn ordinary business software and trusted internet services into covert channels for espionage.
According to Cybersecurity News, Russian hackers have deployed a new Windows backdoor called HOOKEDGE against diplomatic, government, and defense-related organizations across Romania, Spain, and Türkiye. The campaign uses seemingly routine Microsoft Word attachments as the initial entry point before progressing through scripts, scheduled tasks, and browser-based command-and-control.
The activity has been linked with moderate confidence to BlueDelta, a Russia-linked group also tracked as APT28, Fancy Bear, and Forest Blizzard. Researchers describe HOOKEDGE as an evolution of the group’s earlier HEADLACE backdoor.
The campaign begins with spearphishing emails containing macro-enabled Microsoft Word documents.
The documents were designed to appear legitimate. Early samples impersonated material associated with Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, while later documents used generic prompts encouraging recipients to enable content.
Once the victim enables macros, the document’s AutoOpen routine begins the next stage of the attack.
It writes several files into the user’s profile directory, including:
These components work together to launch the installer and establish persistence.
After the initial files are written, the malware creates a Windows scheduled task.
This gives the attackers a mechanism to execute the backdoor again after the initial compromise.
The campaign also removes much of the installation trail afterward. Temporary files and download artifacts are deleted, making post-incident investigation more difficult.
This makes scheduled-task monitoring especially important. A newly created task that launches scripts from a user-writable location can provide a strong indication of malicious persistence.
The most distinctive element of HOOKEDGE is how it communicates with its operators.
Rather than relying on a conventional attacker-controlled command-and-control server, the backdoor uses Microsoft Edge to communicate with a public webhook service.
HOOKEDGE operates as a polling backdoor.
At predetermined intervals, it:
The separation between command retrieval and stolen output gives operators different communication paths for tasking and data collection.
A malicious executable connecting directly to an obvious command-and-control server can generate clear security alerts.
HOOKEDGE takes a different approach.
It uses Microsoft Edge, a legitimate and commonly used browser, to generate its network traffic.
The result is that malicious communication can resemble ordinary web browsing.
This is particularly challenging when security monitoring focuses heavily on domain reputation. A trusted or commonly used web platform does not automatically mean the activity taking place through it is legitimate.
The stronger detection signal is the relationship between the processes involved.
For example:
Word → Script → Scheduled Task → Edge → Webhook Service
That sequence is considerably more suspicious than simply seeing Edge communicate with the internet.
Researchers observed different check-in intervals depending on the victim.
The first-stage scheduled task could contact the operators approximately every 30 minutes.
For selected victims, the attackers deployed another HOOKEDGE instance that checked in as frequently as every five minutes.
This suggests a form of tiered espionage.
The attackers can maintain relatively quiet access across a broader group of victims while increasing the communication frequency for targets considered more valuable.
The campaign also changed its behavior over time, including modifying lure documents, obscuring VBA code, changing Edge execution methods, and adjusting beacon intervals.
One later version of the first-stage malware waited approximately 61 minutes between communications.
This delay may have served two purposes.
First, it reduces consumption of limited webhook requests.
Second, it can help the malware outlast automated sandbox environments that monitor suspicious files for approximately an hour.
If a malicious sample remains dormant beyond the observation window, an automated analysis system may fail to observe its later behavior.
This demonstrates why time-based behavioral analysis can be important when investigating sophisticated malware campaigns.
Researchers identified HOOKEDGE as an evolution of the earlier HEADLACE backdoor.
The two share important characteristics, including:
However, the newer campaign modifies the implementation and communication behavior, demonstrating that the operators continue adapting their tooling.
This is a useful reminder that defenders should not depend entirely on static malware indicators.
A new version of the malware can change filenames, scripts, infrastructure, or timing while preserving the same underlying behavioral patterns.
The campaign provides several behavioral indicators that organizations can monitor.
Particularly suspicious combinations include:
Security teams should also preserve endpoint and proxy logs during an investigation because HOOKEDGE deliberately removes temporary artifacts that could otherwise help reconstruct the attack.
Seceon’s aiXDR-PMax is particularly relevant to the endpoint behavior associated with HOOKEDGE.
It can help security teams detect and correlate:
This behavioral approach is important because the attackers rely heavily on legitimate Windows components.
The presence of Word, Edge, VBScript, or scheduled tasks alone is not necessarily malicious. Their execution sequence and relationship can reveal the attack.
Seceon’s aiSIEM / CGuard can provide broader correlation across the environment.
It can connect:
This allows SOC teams to build a complete timeline rather than investigating individual events separately.
For HOOKEDGE, the ability to correlate Word launching scripts, scripts establishing persistence, and Edge communicating with unusual webhook paths can provide a much stronger detection signal.
aiBAS360 can help organizations validate whether their existing controls can identify similar attack paths.
Security teams can use controlled validation to test scenarios involving:
This helps determine whether the organization’s security controls can detect the behavior of an evolving espionage campaign rather than relying exclusively on known HOOKEDGE indicators.
The HOOKEDGE campaign demonstrates how modern espionage operations can remain remarkably lightweight while still providing attackers with persistent remote access.
The attackers do not need a complicated custom command-and-control infrastructure. Instead, they combine macro-enabled Word documents, Windows scripting, scheduled tasks, Microsoft Edge, and a public webhook service to create a covert communication channel.
The most important defensive lesson is that trusted software can still participate in an untrusted attack chain.
Microsoft Word may be legitimate. Microsoft Edge may be legitimate. Windows Task Scheduler may be legitimate. A webhook service may also be legitimate.
But when those components appear in a sequence such as Word → script → scheduled task → hidden Edge → webhook, the combined behavior tells a very different story.
For organizations handling diplomatic, government, defense, or other sensitive information, continuous behavioral monitoring and cross-event correlation are essential to detecting these low-profile intrusion techniques before they become long-term espionage footholds.
