APT28 Is Back With a New Backdoor and the Same Old Tricks
Researchers at Recorded Future's Insikt Group have identified a cluster of intrusion campaigns hitting government and diplomatic targets across Romania, Spain, and Türkiye. The activity ran from late September 2025 through early April 2026 and resulted in the deployment of a previously unknown backdoor they're calling HOOKEDGE.
The group behind it? APT28. Also known as Fancy Bear, Forest Blizzard, and tracked by Recorded Future as BlueDelta, this is the Russian state-sponsored outfit that's been making a mess of European networks for years. Attribution here is assessed with moderate confidence, based on meaningful overlap with HEADLACE, a modular backdoor APT28 has been using against diplomats since April 2023.
HOOKEDGE itself is not complicated. It's a Windows batch script, delivered via macro-enabled Word documents dressed up as diplomatic correspondence. Early versions impersonated Spanish government materials before operators shifted approach a month in. Standard social engineering fare, but it works.
Once a target opens the document and clicks 'Enable Content', the macro writes six files to the user profile directory and kicks off an installer chain. A scheduled task is created to run every 30 minutes, launching the backdoor. The installer then deletes itself and the related files to reduce forensic traces. Tidy, if unspectacular.
The lure document also embeds a hidden image that pings a webhook.site URL the moment the file is opened, alerting operators that a target has taken the bait.
Where this gets interesting is the C2 mechanism. Rather than standing up dedicated infrastructure, APT28 is routing everything through webhook.site, a legitimate service. HOOKEDGE polls this for .cmd payloads to execute, then ships the output back via the same channel, with Microsoft Edge running headless to make the HTTP requests. It blends into normal traffic and leaves no bespoke server to take down.
There's a practical constraint, though. Webhook.site's free tier caps requests at 100 per unique endpoint, which at a 30-minute polling interval gives you roughly two to three days before the quota runs dry. The solution? A two-tier architecture. Broad initial access runs on one set of webhooks, and high-value targets get escalated to dedicated second-stage endpoints with beaconing intervals as short as five minutes. This keeps the initial-access infrastructure clean and extends the operational shelf life of each endpoint.
It's a clever workaround to a self-imposed constraint, born entirely from choosing free-tier infrastructure over purpose-built servers. Whether that's budget discipline or deliberate operational security is unclear, but it does make attribution and takedowns harder.
Recorded Future notes that APT28 has also removed the document-open canary in later versions, the hidden image that captured victim IP addresses. The reason isn't confirmed, but reducing network-based indicators of compromise is the most obvious explanation.
The defensive guidance is straightforward: block macros from internet-sourced documents, watch for scheduled task creation, flag headless Edge processes, and monitor outbound connections to webhook services. None of this is exotic detection work.
The broader takeaway from Recorded Future's analysis is that APT28 isn't chasing novelty. HOOKEDGE isn't a technical leap forward. It's a refined, operationally resilient evolution of existing tooling, built to stay effective against improving defences without requiring significant new investment. Incremental, patient, and aimed squarely at European diplomatic intelligence. Business as usual for Fancy Bear.