As reported by Security Affairs, Recorded Future's Insikt Group has documented a seven-month espionage campaign by BlueDelta — the GRU-linked group overlapping with APT28, Fancy Bear, and Forest Blizzard — targeting government and diplomatic organizations in Romania, Spain, and Türkiye. The campaign deployed a lightweight backdoor dubbed HOOKEDGE via macro-enabled Word documents with diplomatic-themed lures, using webhook.site as its command-and-control infrastructure and Microsoft Edge as its network transport.

Threat Intelligence: As reported by Security Affairs, Recorded Future's Insikt Group has documented a seven-month espionage campaign by BlueDelta — the GRU-linked group overlapping with APT28, Fancy Bear, and Forest Blizzard — targeting government and diplomatic organizations in Romania, Spain, and Türkiye.

Why This Campaign Matters Beyond the Headline

The individual components here are not novel. Macro-enabled phishing documents, scheduled tasks for persistence, and living-off-the-land techniques are all well-established tradecraft. What makes HOOKEDGE noteworthy is the deliberate composition: stitching together a developer-testing service, a stock browser binary, and batch scripting into an espionage platform that is extraordinarily difficult to distinguish from legitimate enterprise activity.

This is not a sophisticated malware framework. It is a minimalist design choice that trades capability for stealth — and that tradeoff is increasingly the preferred approach for state-sponsored groups that prioritize longevity over feature richness.

The webhook.site Problem

Using webhook.site as a C2 channel is a particularly clever abuse. The service is designed for developers to inspect HTTP requests, which means traffic to it is not inherently suspicious. Many legitimate engineering and DevOps workflows generate requests to webhook.site. Blocking it wholesale will break business processes. Allowlisting it gives attackers a free corridor. This is the exact dilemma defenders face with increasing frequency as threat actors migrate to legitimate cloud and SaaS platforms for infrastructure.

The core detection challenge is no longer 'what binary is making this connection' but 'is this specific process-context combination consistent with how this service is used in our environment.'

Browser-as-C2: The LOLBin Evolution

HOOKEDGE's use of msedge.exe for both tasking and exfiltration deserves specific attention. Traditional LOLBin abuse — certutil, bitsadmin, mshta — is well-documented and increasingly flagged by EDR solutions. Launching network activity through a real browser process bypasses binary-reputation checks, blends with the largest traffic source in most enterprises, and makes process-level network monitoring far less useful as a detection signal.

The 30-minute scheduled task cadence is also calibrated to avoid volume-based anomaly detection. Low-frequency, browser-mediated beacons are the sweet spot where many behavioral analytics engines lose signal.

Who Is at Risk

Who Is at Risk
Government and diplomatic organizations — particularly those involved in Eastern European geopolitics, NATO coordination, or Moldova-adjacent policy work
Defense contractors and think tanks — typical secondary targets in GRU collection operations
Any organization with permissive macro policies — the initial access vector remains viable despite years of Microsoft hardening
Environments with broad outbound web access — where webhook.site and similar services are reachable without inspection

Shield53 Recommendations

Immediate Actions

  • Hunt for HOOKEDGE indicators: Search for scheduled tasks executing batch scripts that invoke msedge.exe with headless or URL parameters pointing to webhook.site endpoints. Look for the 30-minute recurrence pattern.
  • Inspect macro-enabled document delivery: Review email gateway and endpoint logs for Word documents with macros delivered to government-adjacent personnel, especially those with diplomatic themes.
  • Monitor webhook.site traffic: If the service is not used in your environment, block it at the proxy. If it is used, implement context-aware monitoring — flag requests from non-developer endpoints, scheduled tasks, or batch-origination contexts.

Strategic Defenses

  • Disable macros by default via Group Policy or Microsoft Defender for Office. This single control would have neutralized the entire HOOKEDGE delivery chain.
  • Deploy browser process telemetry: Correlate msedge.exe network activity with parent process context. A scheduled task spawning Edge to fetch a URL is not normal user browsing behavior.
  • Adopt DNS-based C2 detection: Even when traffic blends at the process level, DNS resolution patterns for developer-testing services from non-developer endpoints can surface anomalies.
  • Review scheduled task hygiene: Establish a baseline of legitimate scheduled tasks and alert on new ones involving script interpreters or browser binaries.

The broader lesson is that defenders cannot rely on infrastructure reputation alone. webhook.site, Microsoft Edge, and scheduled tasks are all legitimate — but their combination in a specific operational pattern is not. Detection must shift from 'is this tool malicious' to 'is this usage pattern consistent with our environment's baseline.' That requires better telemetry, stronger baselining, and a willingness to investigate the unremarkable.