HOOKEDGEHOOKEDGE

Lightweight Windows backdoor written as batch scripts with VBS launchers, reported by Recorded Future's Insikt Group as a successor to HEADLACE. Delivered through macro-enabled Word documents that show a fake error, drop six files and create a scheduled task, it fetches and runs .cmd payloads and returns their output, using webhook.site exclusively for command and control (separate staging and exfiltration webhooks) with requests issued through hidden Microsoft Edge instances to blend with browsing traffic. Insikt attributes it with moderate confidence to BlueDelta, which it describes as overlapping APT28, against government, diplomatic and defense targets in Europe. In October 2026 Symantec reported its use by APT28 against two defense contractors and a law enforcement agency in two NATO countries.