BlueDelta Deploys HOOKEDGE Against Defense and Diplomatic Targets

Summary

The Russian state-sponsored threat group BlueDelta has conducted initial access campaigns using a lightweight Windows batch-script backdoor called HOOKEDGE. The group delivers the malware through macro-enabled Microsoft Word documents containing diplomatic-themed lures and abuses legitimate webhook services for command-and-control and data exfiltration. The campaigns primarily target government and diplomatic organizations in support of Russian intelligence objectives.

Investigation

Insikt Group identified multiple campaigns between late 2025 and early 2026 targeting organizations in Romania, Spain, and Türkiye. The investigation determined that HOOKEDGE is an evolutionary successor to the HEADLACE backdoor, sharing core architecture and operational tradecraft. Analysts also observed a tiered model in which a first-stage implant performs initial triage before a more capable second-stage payload is deployed to high-value targets.

Mitigation

Organizations should disable macros in documents originating from the internet and enforce policies that block unsigned VBA macros. Security teams should monitor for scheduled task abuse and unusual Microsoft Edge execution, including headless mode. Inspecting outbound traffic to legitimate webhook services such as webhook.site can also help identify potential command-and-control activity.

Response

If BlueDelta activity is detected, security teams should investigate suspicious scheduled task creation and unusual browser automation behavior. Responders should determine the scope of the initial compromise using document-open canaries and network telemetry. Containment efforts should prioritize blocking identified webhook endpoints and strengthening Microsoft Office security controls.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary sends a phishing email containing a Word document. When the victim enables macros, a VBA script executes. Instead of downloading a binary directly, the macro uses the Shell function to launch msedge.exe with a specific URL. This technique uses the legitimate browser to bypass firewall restrictions and provides a “living-off-the-land” method to reach a malicious site or exfiltrate data via HTTP/S. The goal is to trigger the detection rule’s specific ParentImage == winword.exe and Image == msedge.exe logic.

• Regression Test Script:

  # Simulation Script: Triggering BlueDelta HOOKEDGE Detection Logic
  # This script simulates the behavior of a macro-enabled Word document launching Edge.
  
  $WordPath = "C:Program FilesMicrosoft OfficerootOffice16WINWORD.EXE"
  $EdgePath = "C:Program Files (x86)MicrosoftEdgeApplicationmsedge.exe"
  
  if (-not (Test-Path $WordPath)) {
      Write-Error "Word executable not found at $WordPath. Please adjust path."
      exit
  }
  
  Write-Host "[*] Starting Simulation: Launching Winword..."
  $WordProcess = Start-Process -FilePath $WordPath -PassThru
  
  # Simulate the "Macro" execution by having the Word process spawn Edge
  # In a real scenario, this is done via VBA: Shell("msedge.exe http://malicious.com")
  Write-Host "[*] Simulating VBA Macro execution: Spawning msedge.exe from winword.exe..."
  
  # We use a trick to make the child process appear as a child of Winword.
  # Since we cannot easily inject into a running Word process without advanced tools, 
  # we simulate the behavior by launching a sub-process that mimics the lineage 
  # or we use a tool like PowerShell to trigger the specific parent-child relation 
  # if the environment allows, but for a pure simulation of the LOGIC:
  
  $Action = {
      Start-Process -FilePath $EdgePath -ArgumentList "https://www.google.com"
  }
  
  # To ensure the parent is Winword, we execute a command that launches Edge
  # Note: In a real test, a developer would use a compiled DLL or actual VBA.
  # Here, we utilize a PowerShell command that acts as the bridge.
  Start-Process -FilePath "powershell.exe" -ArgumentList "-Command & {$Action}" -WindowStyle Hidden
  
  # NOTE: For the EXACT detection rule provided, the rule expects WINWORD -> MSEDGE.
  # If the rule is strictly 'ParentImage endswith winword.exe', 
  # a true red team tool (like a custom VBA macro) is required.
  
  Write-Host "[+] Simulation command sent. Monitor SIEM for winword.exe -> msedge.exe"
  Start-Sleep -Seconds 10
  Stop-Process -Id $WordProcess.Id -Force

• Cleanup Commands:

  # Cleanup: Ensure no lingering processes from the simulation
  Stop-Process -Name "winword" -ErrorAction SilentlyContinue
  Stop-Process -Name "msedge" -ErrorAction SilentlyContinue
  Stop-Process -Name "powershell" -ErrorAction SilentlyContinue