The Browser Is the Cover: Inside BlueDelta's HOOKEDGE Campaign Against European Diplomacy- 337
September 2, 2026
A phishing document that looks exactly like a real government meeting agenda is a familiar enough trick. What makes the campaign Recorded Future's Insikt Group has been tracking since late September 2025 worth attention is what happens after a target opens it: no exotic malware, no custom command infrastructure, nothing that would stand out on a network diagram — just a Windows batch script quietly using Microsoft Edge to talk to a developer testing tool called webhook.site, in traffic that looks, to any automated defense watching for the usual signs of espionage, like an employee checking a webpage.
The group behind it, tracked by Recorded Future as BlueDelta, overlaps with the Russian GRU-linked actor more widely known as APT28, Fancy Bear, or Forest Blizzard — attributed, per Insikt Group's assessment, to Russia's Main Directorate of the General Staff of the Armed Forces. Between late September 2025 and early April 2026, the group ran a campaign against government and diplomatic targets in Romania, Spain, and Türkiye, built around a previously undocumented backdoor Insikt Group has named HOOKEDGE. One lure document is especially telling: it impersonated material from Spain's Ministry of the Presidency, Justice and Relations with the Cortes, styled to look like it followed an actual meeting between Spanish and Moldovan officials — timed to land shortly before Moldova's September 2025 parliamentary elections. The credibility of that specific pretext, referencing a real diplomatic encounter at a politically sensitive moment, is precisely what made the phishing attempt effective enough to matter.
HOOKEDGE's delivery mechanism is old-fashioned by design: a macro-enabled Microsoft Word document that prompts the target to click "Enable Content." Once enabled, the macro writes six files into the user's profile directory and kicks off an installer chain — an installer launcher creates a scheduled task that runs every 30 minutes to execute the HOOKEDGE backdoor, after which the installer deletes itself, the launcher, and the task definition file, stripping away much of the forensic trail before an investigation would even begin. The backdoor itself is deliberately unsophisticated: a polling loop that fetches command files from a staging webhook, executes them, and returns the output to a separate webhook endpoint, using an HTML file to package the results. What makes the design worth calling out isn't the malware — it's the delivery mechanism. Rather than a common living-off-the-land binary or a custom network client, HOOKEDGE routes both tasking and exfiltration through an actual instance of Microsoft Edge, run headless or in a hidden window. Traffic generated by a real browser reaching a real website is, by design, close to invisible to defenses tuned to catch unusual outbound connections — the entire evasion strategy amounts to making espionage traffic indistinguishable from an employee browsing the internet.
The infrastructure choice carries its own constraint, and BlueDelta's response to it is a small case study in operational planning. Webhook.site's free tier caps any single endpoint at 100 requests, which a 30-minute beaconing interval would exhaust within two to three days. BlueDelta's answer was a two-stage architecture: the first-stage implant handles broad initial access on the standard interval, while victims who show signs of higher intelligence value get moved to a dedicated second-stage HOOKEDGE payload beaconing as frequently as every five minutes, giving operators near-interactive control over the targets judged worth deeper collection. That separation keeps routine initial-access infrastructure from being burned through by the demands of active, high-priority tasking — a triage system built entirely around the limitations of a free developer tool never designed to support espionage traffic in the first place.
BlueDelta has also continued refining the operation rather than treating it as finished. Recorded Future documented beaconing intervals stretched from 30 minutes out to 61 — a change apparently timed specifically to outlast the roughly one-hour observation window that many automated sandbox environments use before concluding a sample is benign. The group's document-open tracking has also evolved: canary tracking pixels with names like mailopened.jpg and docopened.jpg let operators monitor, in sequence, whether a phishing email was opened, whether the document itself was opened, and whether macros actually executed — a funnel-analytics approach to phishing campaign performance that would be unremarkable from a marketing team and is considerably more unsettling applied to espionage victims. (As flagged above, one account describes this specific canary mechanism as removed in later versions rather than renamed; readers should treat that detail as unresolved between sources.)
None of HOOKEDGE's individual components are new. Insikt Group assesses with moderate confidence that it is a direct evolutionary successor to HEADLACE, a modular backdoor BlueDelta has used against diplomatic targets since April 2023, citing significant overlap in core architecture, identical JavaScript variable names, and a shared base64 encoding scheme for automated downloads — the kind of granular code-level continuity that supports the assessment this is the same operators refining working tooling rather than a different team building something new. That pattern is the more significant finding than any single technical trick: BlueDelta's investment isn't in novel capability but in operational resilience — adapting established tradecraft to evade specific defensive countermeasures and infrastructure constraints as they arise, rather than reinventing its approach from scratch. Recorded Future's own assessment is that this activity is unlikely to slow down, given the enduring intelligence value Russia places on European governance, NATO-related affairs, and diplomatic engagement with former Soviet states.
