It takes its commands from the webhook.site service and sends the results back to it. Recorded Future's Insikt Group attributes it with moderate confidence to BlueDelta, which overlaps with APT28. Symantec's researchers found it in attacks on organizations in two NATO countries.
What it does
HOOKEDGE works as a loop. Recorded Future says a first stage scheduled task starts it every 30 minutes. Other samples used 20 minutes, and the group later raised the interval to 61 minutes. Each run fetches a command file from a staging webhook through Microsoft Edge, runs it, and posts the output to a second webhook, again through Edge. Because the browser makes the connection, the traffic looks like normal browsing. Symantec saw the browser started in a one pixel window placed off screen.
Recorded Future assesses HOOKEDGE as a likely successor to HEADLACE, an earlier BlueDelta backdoor. At a naval shipbuilder Symantec found more:
- a second HOOKEDGE stage that talked to a dedicated IP address instead of webhook.site
- an SSH tunnel
- a script that captures NTLM logins
- a reflective loader called ld.exe (see reflective code loading)
Recorded Future lists ATT&CK ids in an appendix to its report; Symantec gives none. The technique list on this page is our own mapping of the behavior both reports describe. The full story is in our analysis of the Swallowtail campaign.
Names
Public sources use several names for this malware.
What it can do
The ATT&CK techniques the cited sources map to this tool, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Initial Access
Execution
Persistence
Stealth
Obfuscated Files or Information T1027
The macro source is split into short fragments that are joined at run time.[1]
Hide Artifacts: Hidden Window T1564.003
Edge runs in a one pixel window placed off screen, or headless.[1, 2]
Reflective Code Loading T1620
At one victim the loader ld.exe decrypted a file in memory and called an exported function named ExecuteLoader.[1]
Command and Control
Web Service: Bidirectional Communication T1102.002
Tasks come from webhook.site and results go back to it.[1, 2]
Ingress Tool Transfer T1105
Operators pushed an SSH key and the files ld.exe and Events.dat through the same fetch path.[1]
Protocol Tunneling T1572
At one victim the operators used the backdoor to push an SSH key and open a background tunnel to their own server.[1]
Exfiltration
How it spreads
HOOKEDGE does not spread on its own. Both reports describe macro-enabled Word documents, likely sent as email attachments. Recorded Future saw lures that posed as a Spanish ministry document listing the topics of a meeting and later generic lures that asked the reader to click Enable Content. Symantec says the document at the shipbuilder was opened from the Outlook attachment cache on 24 July 2026, which shows it arrived by email.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Lure arrives
A Word document with a macro, likely sent as an email attachment. Symantec saw it opened from the Outlook cache on 24 July 2026.[1, 2]
Macro runs
The AutoOpen routine drops script files into the user profile: a VBScript launcher, an HTML and XHTML pair and a batch script. Recorded Future counts six files, Symantec four.[1, 2]
Task fetched
A hidden Edge window loads a webhook.site address and saves the reply to disk. The reply is turned into a cmd file and run.[1, 2]
Result posted
The output is wrapped in the HTML pair and sent to a separate webhook by an auto-submitted form.[2]
Loop repeats
A scheduled task repeats this, every 30 minutes in the first stage; Recorded Future also saw 20 and 61 minute intervals. Recorded Future says some victims later got a second stage that beacons as often as every five minutes.[2]
Follow-on at one victim
Symantec saw a second stage that used a dedicated IP address, an SSH tunnel, NTLM capture and the loader ld.exe.[1]
Timeline
- 26 September 2025
First lure seen
Recorded Future's earliest lure, posing as a Spanish ministry document listing the topics of a meeting.[2]
- 7 October 2025
Generic lures begin
Lures change to a generic Enable Content prompt, with a 20 minute beacon interval.[2]
- 4 December 2025
Hidden window
Edge now runs in a hidden window instead of headless mode.[2]
- 20 January 2026
Email open canary
Recorded Future sees a mailopened.jpg canary in network telemetry.[2]
- April 2026
Türkiye
Recorded Future identifies variants that, by network telemetry, targeted organizations in Türkiye.[2]
- 24 July 2026
Shipbuilder compromised
Symantec says a Word document was opened at a naval shipbuilder.[1]
- 27 July 2026
Second stage
A second HOOKEDGE stage fetches tasks from a dedicated IP address, and an SSH tunnel is opened.[1]
- 31 July 2026
Loader run
The operators run ld.exe with an encrypted file named Events.dat.[1]
- August 2026
- 24 September 2026
Latest activity
Symantec saw the HOOKEDGE launcher on the shipbuilder host again.[1]
- 20 October 2026
Symantec report
Symantec publishes its findings on two NATO countries.[1]
Who uses it
Detection and defense
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Cyber Threat Intelligence
Brandefense Cyber Threat Intelligence tracks malware families and the infrastructure they use, and shares indicators your team can check against its own systems.
Frequently Asked Questions
What is HOOKEDGE?
A Windows backdoor made of batch scripts, delivered through Word documents with a macro. It runs commands from webhook.site and sends the results back.
Who uses HOOKEDGE?
Recorded Future attributes it with moderate confidence to BlueDelta, which overlaps with APT28. Symantec found it in attacks by Swallowtail, its name for APT28, on organizations in two NATO countries.
Is webhook.site malicious?
No. Recorded Future describes it as a legitimate service for receiving web requests. The group abuses it because its traffic blends with normal web use.
How can I check for HOOKEDGE?
Look for scheduled tasks that run scripts from user folders, Edge started with a data URL or off-screen window, and connections to webhook.site. Search for the hashes and IP address in the Symantec report.
Does a HOOKEDGE find mean the attack is over?
Not necessarily. Symantec says to treat it as potentially ongoing and to look for tunnels, credential theft and the ld.exe loader.
Sources
- Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO CountriesSymantec (Broadcom) · Supports: 20 October 2026: shipbuilder intrusion, attack chain, ld.exe, indicators
- BlueDelta Targets Defense and Diplomacy with HOOKEDGERecorded Future Insikt Group · Supports: August 2026: first report, attribution, files, two webhook design, changes over time, mitigations
- APT28 (G0007)MITRE ATT&CK · Supports: Swallowtail, Fancy Bear and Forest Blizzard as names of APT28
- T1102.002 Web Service: Bidirectional CommunicationMITRE ATT&CK · Supports: Technique id and name
- T1204.002 User Execution: Malicious FileMITRE ATT&CK · Supports: Technique id and name
- T1053.005 Scheduled Task/Job: Scheduled TaskMITRE ATT&CK · Supports: Technique id and name
- T1620 Reflective Code LoadingMITRE ATT&CK · Supports: Technique id and name
- T1572 Protocol TunnelingMITRE ATT&CK · Supports: Technique id and name
