Threat Overview
Recorded Future’s Insikt Group documented HOOKEDGE, a lightweight Windows batch backdoor used in campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye. The campaigns ran from late September 2025 through early April 2026 and used macro-enabled Microsoft Word documents with diplomatic-themed lures.
HOOKEDGE creates a scheduled task that runs every 30 minutes, polls webhook.site for .cmd payloads, executes commands, and exfiltrates output through Microsoft Edge launched in headless mode or a hidden window. High-value targets can receive a second-stage payload with a five-minute beacon interval. Recorded Future attributed the activity to BlueDelta/APT28 with moderate confidence based on code and tradecraft overlap with the earlier HEADLACE backdoor; that attribution is an assessment, not a directly proven fact.
References
Impacted Systems
| Platform | Windows endpoints |
| Initial access | Macro-enabled Microsoft Word documents using diplomatic/government-themed lures |
| Execution | Windows batch-script backdoor and remotely fetched .cmd payloads |
| Persistence | Scheduled task executing every 30 minutes; second-stage variants can beacon every 5 minutes |
| Command and control | webhook.site used for C2, payload staging, and data exfiltration |
| Living-off-trusted-software | Microsoft Edge launched headless or hidden to perform HTTP requests |
| Targeting observed | Government and diplomatic organizations in Romania, Spain, and Türkiye |
| Attribution | BlueDelta / APT28 with moderate confidence per Recorded Future |
| Known activity | Confirmed campaign activity; attribution confidence is moderate |
What this hunt looks for
Looks for Word-to-script execution, scheduled-task-driven batch activity, headless or hidden Microsoft Edge execution, and outbound connections to webhook.site.
Required logs
DeviceProcessEvents and DeviceNetworkEvents from endpoint telemetry. SecurityEvent Event ID 4688 can provide a fallback where command-line auditing is enabled.
First-Pass — Word Spawning Batch or Command Execution
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "WINWORD.EXE"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascBehavioral — Headless Edge Contacting webhook.site
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "msedge.exe"
| where RemoteUrl has "webhook.site"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated ascFollow-Up — Headless or Hidden Edge From Scripted Context
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "msedge.exe"
| where ProcessCommandLine has_any ("--headless", "--headless=new", "--window-position", "webhook.site")
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "schtasks.exe")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascFallback — Windows 4688 Process Creation for HOOKEDGE Patterns
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where NewProcessName endswith @"\msedge.exe" or NewProcessName endswith @"\cmd.exe"
| where CommandLine has_any ("webhook.site", "--headless", ".cmd", ".bat")
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName
| sort by TimeGenerated asc
Killian Sherer 