APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Recorded Future's Insikt Group identified HOOKEDGE, a new backdoor deployed via malicious Word documents, targeting government and diplomatic entities in Romania, Spain, and Türkiye from late 2025 to early 2026. The malware is linked to the Russian APT28 group, evolving from their previous HEADLACE backdoor, and uses webhook.site services for covert command-and-control operations.