BlueDelta Deploys HOOKEDGE in Espionage Operations Across Europe

Summary

Russian state-sponsored threat group BlueDelta is using the HOOKEDGE Windows backdoor to target European diplomatic, government, and defense organizations. The malware is delivered through macro-enabled Microsoft Word documents and abuses legitimate services such as webhook.site and Microsoft Edge for C2 communications and data exfiltration. This technique helps the adversary disguise malicious traffic as normal HTTPS browsing.

Investigation

The investigation identified campaign activity from late September 2025 through early April 2026, with additional HOOKEDGE variants observed later in 2026. Analysts documented a tiered operational model in which higher-value targets receive more frequent beaconing. Technical analysis also revealed document-open canaries and abuse of legitimate internet services (LIS) to reduce the campaign’s forensic footprint.

Mitigation

Defenders should prioritize detection of suspicious macro execution originating from Microsoft Office documents. Restricting Windows batch scripts and unauthorized scheduled task creation can help disrupt the infection chain. Security teams should also monitor unusual browser-based network activity, particularly Microsoft Edge connections to unexpected webhook services.

Response

If HOOKEDGE activity is detected, affected hosts should be isolated immediately to prevent additional data exfiltration or lateral movement. Responders should examine the %userprofile% directory for dropped batch, VBScript, or HTML components. Network logs should also be reviewed for unauthorized HTTPS POST requests to webhook.site originating from browser processes.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access and seeks to establish persistence to survive a reboot. Following the TTPs associated with HOOKEDGE, the attacker executes a command via the command line to create a scheduled task named “WindowsUpdateCheck” that runs a malicious payload in a hidden window every hour. This specific action utilizes schtasks.exe, which is the exact trigger for the detection rule.

• Regression Test Script:

  # Simulation script to create a persistence scheduled task using schtasks.exe
  $TaskName = "WindowsUpdateCheck"
  $ActionCommand = "cmd.exe /c echo 'Persistence Established' > C:tempmalicious.txt"
  
  Write-Host "[+] Creating scheduled task: $TaskName" -ForegroundColor Cyan
  
  # This command is designed to trigger the 'schtasks' detection rule
  schtasks /create /sc hourly /mo 1 /tn $TaskName /tr "$ActionCommand" /f
  
  if ($?) {
      Write-Host "[!] Simulation successful: Task created." -ForegroundColor Green
  } else {
      Write-Host "[-] Simulation failed: Check permissions (Run as Admin)." -ForegroundColor Red
  }

• Cleanup Commands:

  # Cleanup script to remove the simulated persistence and artifacts
  $TaskName = "WindowsUpdateCheck"
  Write-Host "[+] Cleaning up simulation..." -ForegroundColor Cyan
  
  schtasks /delete /tn $TaskName /f
  if (Test-Path "C:tempmalicious.txt") {
      Remove-Item "C:tempmalicious.txt" -Force
  }
  
  Write-Host "[+] Cleanup complete." -ForegroundColor Green