Cybersecurity researchers have uncovered a new cyber-espionge campaign targeting government and diplomatic organizations in Romania, Spain, and Türkiye.
Recorded Future’s Insikt Group says the campaigns, active between September 2025 and April 2026, leveraged a previously unknown Windows backdoor called Hookedge. The malware was delivered through malicious Microsoft Word documents designed to look like diplomatic or government-related files.
Victims were encouraged to click “Enable Content,” which allowed a macro inside the document to install the backdoor. Hookedge can receive commands from attackers, run them on the victim’s computer, and send the results back.
Researchers have linked the activity with moderate confidence to the Russian state-backed hacker group, tracked as APT28, Fancy Bear and Forest Blizzard. Recorded Future tracks the activity as BlueDelta.
The connection is based partly on similarities between Hookedge and Headlace, another backdoor previously associated with APT28 attacks against diplomats. Both tools also use webhook[.]site services to communicate with attackers and transfer stolen data, helping the activity blend into normal web traffic.
Researchers say the attackers have repeatedly changed Hookedge and the delivery methods since the start of the campaign to avoid detection, reduce traces left on infected systems, and deal with limits on the services used by the attackers.
High-value targets have also received a second-stage version of the malware that checks for new commands as often as every five minutes.
“BlueDelta continues to invest in lightweight, easily adaptable initial-access tooling to support intelligence collection against European government and diplomatic targets. Rather than introducing new capabilities, the group has steadily refined its existing tradecraft, emphasizing operational resilience by adapting established tooling to evolving defensive measures and infrastructure constraints,” the researchers noted.