APT28 HOOKEDGE: how GRU uses webhook.site for espionage
The campaign
Between late September 2025 and early April 2026, threat actors targeted government and diplomatic organizations in Romania, Spain, and Turkiye with a Windows backdoor called HOOKEDGE. New variants were identified in June and July 2026, indicating the campaign is ongoing.
Recorded Future's Insikt Group assessed with moderate confidence that this activity was conducted by BlueDelta, the cluster that overlaps with APT28, Fancy Bear, and Forest Blizzard: names for operations linked to Russia's GRU military intelligence service.
How HOOKEDGE works
HOOKEDGE is a Windows batch script backdoor. Delivery is via a macro-enabled Microsoft Word document that prompts the target to click 'Enable Content.'
Once installed, HOOKEDGE uses two webhook.site webhooks for its C2 channel. One webhook receives commands from the attacker. A second sends stolen data back. The entire command-and-control infrastructure runs over a legitimate developer testing service that is widely trusted on corporate networks.
HOOKEDGE shows significant code and tradecraft overlap with HEADLACE, a modular Windows backdoor APT28 has used since April 2023. This is an evolution of an existing tool, not a new capability from scratch.
The victim triage system
The beacon intervals reveal how the attackers operate at scale. First-stage HOOKEDGE instances beacon every 30 or 61 minutes. This is slow enough to blend into normal network noise and avoid anomaly detection.
When the attacker identifies a high-value victim, they push a second HOOKEDGE instance configured to beacon every 5 minutes. The faster interval enables real-time tasking on systems worth active operator attention.
This two-tier cadence is how a state actor manages a large campaign without burning resources on every target equally.
The webhook.site problem for defenders
Webhook.site is a legitimate service used by developers to inspect and debug HTTP requests during integration testing. It is on most organizations' allow lists because blocking it would break routine development workflows.
APT28's choice of webhook.site as a C2 channel is deliberate. The domain is trusted. The traffic looks like development activity. Standard domain-reputation blocking will not catch it.
Effective detection for HOOKEDGE requires behavioral analysis: watch for batch scripts making periodic HTTP POST requests to webhook.site with structured payloads, particularly at 30 or 61-minute intervals. A beacon from a system with no development activity associated with it is the anomaly.
Who should care
The targeting to date has been government and diplomatic organizations in Romania, Spain, and Turkiye: three NATO members with specific relevance to Russia's current operational environment. Defense contractors, policy organizations, and enterprises with government client relationships in Europe should include this campaign in their threat model regardless of whether they are based in those countries.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help with nation-state threat detection for your organization.