BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Insikt Group has identified a series of BlueDelta initial access campaigns conducted between late September 2025 and early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye. The campaigns delivered a lightweight Windows batch-script backdoor, dubbed "HOOKEDGE," via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.

Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state- threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). This assessment is based on significant code and tradecraft overlap between HOOKEDGE and the HEADLACE backdoor used in prior BlueDelta campaigns, consistent infrastructure patterns, and targeting consistent with known Russian intelligence collection priorities.

HOOKEDGE shares HEADLACE's core architecture, abusing legitimate webhook services for command-and-control (C2), payload staging, and data exfiltration, enabling malicious activity to blend with legitimate network traffic while reducing the operational overhead of dedicated infrastructure. The implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site .

BlueDelta continues to invest in lightweight, easily adaptable initial-access tooling to support intelligence collection against European government and diplomatic targets. Rather than introducing new capabilities, the group has steadily refined its existing tradecraft, emphasizing operational resilience by adapting established tooling to evolving defensive measures and infrastructure constraints.

Organizations should prioritize blocking macro execution from internet-originated documents and implementing detection coverage for scheduled task abuse, headless Microsoft Edge execution, and outbound connections to webhook services.

BlueDelta is a Russian state- threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), and overlaps with activity publicly tracked as APT28, Fancy Bear, and Forest Blizzard. The group has conducted espionage-focused cyber operations for more than a decade, consistently targeting government, diplomatic, defense, and policy-related organizations in support of Russian intelligence requirements.

BlueDelta has a well-documented history of obtaining initial access through spearphishing, credential theft, and lightweight custom tooling. campaigns have employed malicious documents, Windows batch scripts, and living-off-the-land techniques (LotL), frequently abusing LIS and free web infrastructure for C2, payload staging, and data exfiltration. Insikt Group documented BlueDelta's 2023 use of the HEADLACE malware family, a lightweight, batch-based backdoor used during the early stages of intrusions to execute follow-on payloads and commands in initial access campaigns targeting organizations across Europe.

The activity detailed in this report represents a direct continuation of those operations. The HOOKEDGE backdoor shares significant code and tradecraft overlap with HEADLACE, demonstrating BlueDelta's continued preference for lightweight, easily modified malware that can be rapidly adapted to operational requirements. Similar activity has also been reported publicly by Lab52 under the name Operation MacroMaze .

BlueDelta's choice of lure documents across these campaigns reflects deliberate targeting of European diplomatic audiences and reveals collection priorities consistent with known Russian intelligence requirements. Between late September 2025 and early April 2026, Insikt Group identified several malicious macro-enabled Word documents likely used by BlueDelta in initial access campaigns targeting government or diplomatic personnel in multiple European countries.

The earliest identified lure, first seen on September 26, 2025, purported to be a September 15, 2025, meeting agenda from Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, as shown in Figures 1 and 2 . Although the document’s authenticity could not be verified, BlueDelta has historically used authentic government documents, including publicly available material, as phishing lures.

The document was created shortly after the ministry's September 8, 2025, meeting with Moldovan officials. The timing of this lure document may indicate an attempt to exploit legitimate diplomatic activity, likely of intelligence interest to Russia, ahead of Moldova's September 2025 parliamentary elections.

Between October and December 2025, BlueDelta moved away from using diplomatic lures and instead used a more generic social engineering approach, presenting recipients with either junk data or a prompt instructing them to click to "Enable Content" to display the document, as shown in Figures 3 and 4 .

After enabling macros, a fake Microsoft Word error message was displayed to the user, a technique designed to discourage further scrutiny of the document. This shift away from targeted lure content could suggest that BlueDelta broadened its targeting during this period. These campaigns likely were targeting institutions in Romania.

In early April 2026, Insikt Group identified additional HOOKEDGE variants that, based on network telemetry, targeted organizations in Türkiye.

Insikt Group assesses with medium confidence that the targeting pattern across these campaigns reflects active Russian intelligence collection against European diplomatic targets, particularly those involved in or adjacent to Moldovan political affairs and broader NATO-adjacent European governance.

BlueDelta used macro-enabled Microsoft Word documents, likely delivered via spearphishing attachments, as the primary delivery mechanism for HOOKEDGE, relying on victim interaction to trigger execution and using a multi-stage installer chain designed to establish persistence while minimizing forensic artifacts. The high-level execution flow is illustrated in Figure 5 .

When a recipient opens a lure document and enables macros, the document's AutoOpen() subroutine executes immediately, writing six files to the %userprofile% directory and launching the HOOKEDGE installer chain, as shown in Table 1 . The files dropped to disk serve distinct roles across delivery, execution, persistence, and exfiltration staging.

Table 1: Files dropped by the malicious Word document and their roles in the HOOKEDGE infection chain (Source: Recorded Future)

Once the installer launcher executes, it creates a scheduled task that runs every 30 minutes, launching the HOOKEDGE launcher with the HOOKEDGE payload as its argument. The installer then deletes itself, the installer launcher, and the task definition file, removing the primary installation artifacts from the %userprofile% directory. All dropped files except the installer launcher are named using the globally unique identifier (GUID) associated with the staging/tasking webhook, whereas the installer launcher uses the GUID associated with the exfiltration webhook.

The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg . This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg . Insikt Group also identified webhooks using the filename mailopened.jpg , indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.

Insikt Group assesses that the installer chain's self-deletion behavior reflects a deliberate effort to reduce the forensic footprint of the initial compromise and complicate post-incident investigation.

HOOKEDGE is a lightweight Windows batch backdoor that enables remote command execution by retrieving arbitrary .cmd payloads from a staging webhook, executing them on the infected host, and exfiltrating the resulting output. The simplified execution flow is illustrated in Figure 6 .

At its core, HOOKEDGE operates as a polling loop: each time the scheduled task fires, the backdoor retrieves a command payload from a staging webhook, executes it, and exfiltrates the output to a separate exfiltration webhook. This two-webhook architecture separates tasking from exfiltration. Each execution cycle performs the following sequence:

A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.

HOOKEDGE's code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in campaigns . Both HOOKEDGE and HEADLACE use Windows batch as the primary scripting language, abuse LIS for C2 and exfiltration, and employ hidden browser instances for C2 communication. Additionally, the second-stage payloads retrieved by HOOKEDGE JavaScript code with the payloads previously observed in HEADLACE campaigns, using identical variable names, properties, structure, and base64 encoding schemes for automated file downloads. Insikt Group assesses, with moderate confidence, that HOOKEDGE is a direct evolutionary successor to HEADLACE, developed and maintained by the same operators.

BlueDelta used HOOKEDGE not only as a stand-alone initial access tool but as a delivery mechanism for additional HOOKEDGE payloads configured for more intensive, responsive tasking, indicating a tiered operational model in which initial access infrastructure is used to triage victims and escalate collection against those deemed to be of higher intelligence value.

The second-stage installer is very similar to the initial installer dropped by the lure document. It drops a new HOOKEDGE payload and launcher, and establishes persistence via a new scheduled task. The main differences are the beaconing interval and the C2 URLs. The first-stage scheduled task runs every 30 minutes, whereas the second-stage scheduled task runs as frequently as every five minutes. This shorter time interval allows the operators to issue commands and receive output far more rapidly, supporting interactive post-compromise activity rather than the slower polling cadence of the initial implant.

The two-stage architecture also helps to mitigate one of BlueDelta’s infrastructure constraints. webhook[.]site' s free tier imposes a maximum of 100 requests per unique endpoint, meaning a 30-minute beaconing interval would exhaust a given endpoint's request allocation within approximately two to three days. By moving high-priority victims to dedicated second-stage webhook endpoints, BlueDelta effectively separates initial-access infrastructure from active collection infrastructure, ensuring that ongoing operator tasking and collection do not prematurely exhaust the limited request quotas of the initial-access webhook endpoints.

Insikt Group assesses with moderate confidence that deploying a second HOOKEDGE payload to the same victim constitutes a deliberate triage mechanism. The first-stage implant establishes broad initial access; operators likely use network telemetry, such as document-open canary requests and successful communications with staging or exfiltration webhook endpoints, to identify victims that warrant more intensive tasking. This operational pattern is consistent with BlueDelta’s long-established preference for lightweight, low-noise initial access tooling that supports selective, intelligence-driven follow-on activity.

BlueDelta iteratively refined HOOKEDGE and its delivery throughout the reporting period, modifying lure documents, execution methods, phishing telemetry, and beaconing intervals while preserving the malware’s core architecture. Across observed variants, the group transitioned from diplomatic-themed to generic macro-enablement lures, changed Microsoft Edge execution from headless to a hidden window, and introduced email-open canaries. A summary of all key changes is provided in Table 2 below.

Table 2: HOOKEDGE campaign refinement over time (Source: Recorded Future)

One of the most significant operational changes was increasing the first-stage beacon interval from 30 to 61 minutes. Insikt Group assesses that this adjustment likely reduced the effectiveness of automated sandbox environments that typically monitor execution for up to 60 minutes while also slowing consumption of the finite request quotas imposed by webhook[.]site , extending the operational lifespan of the group’s infrastructure. The introduction of /mailopened.jpg canaries in January 2026 campaigns expanded BlueDelta’s visibility into the phishing lifecycle, allowing operators to distinguish between email opens, document opens, and successful macro execution. This level of phishing delivery tracking is highly useful as a feedback mechanism, allowing BlueDelta to assess the success of each stage of its campaigns.

In July 2026 campaigns, BlueDelta removed the document-open canary — previously, a consistent feature used to capture victim IP addresses at the moment of document opening — from observed HOOKEDGE samples. While the operational motivation behind this change is unclear, it may reflect an intent to reduce network-based indicators of compromise.

BlueDelta has continued to rely on webhook[.]site for all C2, payload staging, and data exfiltration across the campaigns documented in this report. This represents a deliberate infrastructure choice that focuses on detection evasion and operational simplicity over the control and flexibility offered by dedicated infrastructure. This has proven consistently effective against network-based defensive controls.

webhook[.]site is a legitimate, publicly accessible service that allows users to create unique HTTPS endpoints to receive and inspect HTTP requests. In HOOKEDGE operations, BlueDelta uses individual webhook endpoints for distinct functions: document-open and email-open canaries, command and payload staging, and exfiltration capture. Each function is assigned a separate endpoint, and endpoint universally unique identifiers (UUIDs) are reused as filenames for files dropped during installation, a design that ties the infrastructure directly to the implant's file-naming scheme and simplifies operator management of campaign components.

HOOKEDGE’s network communications are designed to blend with legitimate web activity. Outbound connections from infected hosts are directed to a legitimate HTTPS service, with a web browser serving as the HTTP client. This leaves defenders with relatively few anomalous characteristics beyond the specific webhook URLs and execution context. Traffic of this type is resistant to detection approaches that rely on domain or IP reputation, static blocklists, or TLS inspection policies that exempt trusted services.

Across the observed campaigns, BlueDelta administered its webhook[.]site endpoints from NordVPN IP addresses. This use of a commercial virtual private network (VPN) service for infrastructure administration further complicates attribution by removing direct operator IP visibility, and is consistent with BlueDelta's broader operational security practices observed in prior campaigns. The combination of a legitimate web service for C2 and a commercial VPN for administration means that neither the traffic nor its origin provides a reliable attribution signal through conventional network monitoring alone.

The request limits imposed by webhook[.]site ‘s free tier, which allowed a maximum of 100 requests per unique endpoint, likely influenced BlueDelta’s operational tempo. Insikt Group assesses that these constraints drove both the extension of HOOKEDGE’s beaconing interval and the use of dedicated second-stage webhook endpoints for higher-priority targets. Despite these limitations, BlueDelta continued to rely on webhook[.]site , suggesting that the operational benefits of using a legitimate web service outweighed the finite request quotas. The ability to rapidly provision new endpoints at no cost further reduced the impact of these limitations.

BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.

Since it was first detected in September 2025, HOOKEDGE has been continuously improved by BlueDelta. The threat group has changed HOOKEDGE’s delivery mechanisms, beaconing intervals, and infrastructure management practices in response to shifts in the defensive landscape and the operational constraints of webhook[.]site . Further improvements and refinements are likely, and Insikt Group assesses that future changes will probably remain operationally motivated and oriented toward detection evasion and infrastructure resilience.

Given BlueDelta's history of periodically retiring initial-access tooling once it attracts sufficient detection coverage, HOOKEDGE will eventually be superseded. HOOKEDGE’s replacement will probably retain proven tradecraft elements: use of LOLBins, abuse of legitimate web services for C2, and LotL execution. JavaScript-based payload delivery and GUID-formatted file-naming conventions have appeared consistently across both HEADLACE and HOOKEDGE, and these patterns are worth monitoring for continuity into future tooling.

Across all campaigns documented in this report, BlueDelta relied exclusively on webhook[.]site ‘s free tier for command-and-control, payload staging, and data exfiltration. Insikt Group assesses that increased disruption of webhook[.]site , whether through abuse mitigation or defensive detection, would more likely drive a migration to another legitimate web service than to dedicated attacker-controlled infrastructure. This assessment is supported by the group’s migration from mocky[.]io to webhook[.]site during HEADLACE campaigns, demonstrating a preference for adapting legitimate infrastructure rather than operating its own.

Explore expert insights, reports, and tools to strengthen your cybersecurity strategy.