Quick links
Press Enter to search, Esc to close
Malware profile
HOOKEDGE is a lightweight Windows backdoor made of batch scripts, delivered through Word documents that carry a macro.
In short
HOOKEDGE is a lightweight Windows backdoor made of batch scripts, delivered through Word documents that carry a macro. It takes its commands from the webhook.site service and sends the results back to it. Recorded Future's Insikt Group attributes it with moderate confidence to BlueDelta, which overlaps with APT28. Symantec's researchers found it in attacks on organizations in two NATO countries.
HOOKEDGE works as a loop. Recorded Future says a first stage scheduled task starts it every 30 minutes. Other samples used 20 minutes, and the group later raised the interval to 61 minutes. Each run fetches a command file from a staging webhook through Microsoft Edge, runs it, and posts the output to a second webhook, again through Edge. Because the browser makes the connection, the traffic looks like normal browsing. Symantec saw the browser started in a one pixel window placed off screen.
Recorded Future assesses HOOKEDGE as a likely successor to HEADLACE, an earlier BlueDelta backdoor. At a naval shipbuilder Symantec found more:
Recorded Future lists ATT&CK ids in an appendix to its report; Symantec gives none. The technique list on this page is our own mapping of the behavior both reports describe. The full story is in our analysis of the Swallowtail campaign.
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| HOOKEDGE | Name used by Recorded Future (August 2026) and Symantec, which writes Hookedge[1, 2] |
| HEADLACE | Earlier BlueDelta backdoor that Recorded Future calls the likely predecessor[2] |
| Operation MacroMaze | Name Lab52 gave to similar activity, as Recorded Future reports it[2] |
| ld.exe | File name of the reflective loader Symantec found in the same intrusion[1] |
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Obfuscated Files or Information T1027
The macro source is split into short fragments that are joined at run time.[1]
Hide Artifacts: Hidden Window T1564.003
Edge runs in a one pixel window placed off screen, or headless.[1, 2]
Reflective Code Loading T1620
At one victim the loader ld.exe decrypted a file in memory and called an exported function named ExecuteLoader.[1]
Web Service: Bidirectional Communication T1102.002
Tasks come from webhook.site and results go back to it.[1, 2]
Ingress Tool Transfer T1105
Operators pushed an SSH key and the files ld.exe and Events.dat through the same fetch path.[1]
Protocol Tunneling T1572
At one victim the operators used the backdoor to push an SSH key and open a background tunnel to their own server.[1]
HOOKEDGE does not spread on its own. Both reports describe macro-enabled Word documents, likely sent as email attachments. Recorded Future saw lures that posed as a Spanish ministry document listing the topics of a meeting and later generic lures that asked the reader to click Enable Content. Symantec says the document at the shipbuilder was opened from the Outlook attachment cache on 24 July 2026, which shows it arrived by email.
The order of steps in a typical infection, as the sources describe it.
A Word document with a macro, likely sent as an email attachment. Symantec saw it opened from the Outlook cache on 24 July 2026.[1, 2]
The AutoOpen routine drops script files into the user profile: a VBScript launcher, an HTML and XHTML pair and a batch script. Recorded Future counts six files, Symantec four.[1, 2]
A hidden Edge window loads a webhook.site address and saves the reply to disk. The reply is turned into a cmd file and run.[1, 2]
The output is wrapped in the HTML pair and sent to a separate webhook by an auto-submitted form.[2]
A scheduled task repeats this, every 30 minutes in the first stage; Recorded Future also saw 20 and 61 minute intervals. Recorded Future says some victims later got a second stage that beacons as often as every five minutes.[2]
Symantec saw a second stage that used a dedicated IP address, an SSH tunnel, NTLM capture and the loader ld.exe.[1]
Recorded Future's earliest lure, posing as a Spanish ministry document listing the topics of a meeting.[2]
Lures change to a generic Enable Content prompt, with a 20 minute beacon interval.[2]
Edge now runs in a hidden window instead of headless mode.[2]
Recorded Future sees a mailopened.jpg canary in network telemetry.[2]
Recorded Future identifies variants that, by network telemetry, targeted organizations in Türkiye.[2]
Symantec says a Word document was opened at a naval shipbuilder.[1]
A second HOOKEDGE stage fetches tasks from a dedicated IP address, and an SSH tunnel is opened.[1]
The operators run ld.exe with an encrypted file named Events.dat.[1]
Symantec saw the HOOKEDGE launcher on the shipbuilder host again.[1]
Symantec publishes its findings on two NATO countries.[1]
A Windows backdoor made of batch scripts, delivered through Word documents with a macro. It runs commands from webhook.site and sends the results back.
Recorded Future attributes it with moderate confidence to BlueDelta, which overlaps with APT28. Symantec found it in attacks by Swallowtail, its name for APT28, on organizations in two NATO countries.
No. Recorded Future describes it as a legitimate service for receiving web requests. The group abuses it because its traffic blends with normal web use.
Look for scheduled tasks that run scripts from user folders, Edge started with a data URL or off-screen window, and connections to webhook.site. Search for the hashes and IP address in the Symantec report.
Not necessarily. Symantec says to treat it as potentially ongoing and to look for tunnels, credential theft and the ld.exe loader.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
