Executive Summary
- •Russian state-backed group APT28 targeted European diplomats with a newly discovered backdoor dubbed HOOKEDGE.
- •The campaign bypassed infrastructure caps by routing high-value victims to dedicated endpoints with five-minute beacon intervals.
- •Security defenders must now restrict macro execution and monitor headless browser automation to prevent compromise.
Community Sentiment
AFFILIATE PARTNER30-Day Money-Back Policy • Encrypted Traffic
Encrypt your connection and network traffic with NordVPN
Get NordVPN
Affiliate disclosure: We may earn a commission if you subscribe through this link.
Key Developments & Data
Cybersecurity researchers revealed that threat group APT28 targeted government and diplomatic entities across Romania, Spain, and Türkiye between late September 2025 and early April 2026.
The campaign deployed HOOKEDGE, an undocumented Windows batch script backdoor distributed through macro-enabled Word documents using diplomatic-themed lures.
Operators abused webhook-site endpoints for command-and-control, payload staging, and data exfiltration, executing commands through Microsoft Edge in headless mode.
A two-stage architecture was deployed to bypass webhook-site free-tier limits of 100 requests per endpoint, shifting high-priority targets to dedicated second-stage endpoints with beacon intervals as low as five minutes.
"BlueDelta continues to invest in lightweight, easily adaptable initial-access tooling to support intelligence collection against European government and diplomatic targets." — Recorded Future
Zubiqo Strategic Assessment
Primary Impact
European diplomatic bodies, foreign ministries, and government agencies in Romania, Spain, and Türkiye.
Strategic Shift
Nation-state advanced persistent threat groups transitioning from bespoke command-and-control infrastructure to abusing legitimate public developer APIs and cloud webhooks.
The Ripple Effect
Enterprise security teams will enforce strict outbound egress controls and domain-level blocking against public testing and webhook platforms.
This intelligence assessment is generated by Zubiqo's AI for informational purposes only.
Intelligence Quality Rating
Grade this brief: Slide & release to submit rating, or tap a preset.
🔥High Impact75/100
Slide & release to voteImmune to accidental scroll
Zubiqo Briefing
The daily signal, delivered every weekday.
A concise weekday briefing on AI, technology and business. Zero PR fluff.
Subscribe directly on Substack
Subscription completes on Substack • Free • 1-click unsubscribe anytime
✓ Free on Substack✓ Official Substack enrollment✓ 1-click unsubscribe
