APT28-Linked HOOKEDGE Backdoor Hit European Governments
Recorded Future Insikt Group identified APT28-linked campaigns deploying HOOKEDGE, a previously undocumented Windows batch backdoor, against government targets in Romania, Spain, and Türkiye.
Morgan "airgap" ReyesAPT28-linked campaigns confirmed against European government and diplomatic targets. Recorded Future Insikt Group published research on a series of intrusions hitting organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026.
The tool deployed: HOOKEDGE. A previously undocumented backdoor. Implemented as a lightweight Windows batch script.
What Is Confirmed
Targets. Government and diplomatic organizations in Romania, Spain, and Türkiye.
Active window. Late September 2025 through early April 2026. The campaign window has closed; active intrusion operations are not confirmed as of this writing.
Malware. HOOKEDGE, a Windows batch script backdoor not previously documented in public threat research. Lightweight by design: batch scripts require no additional runtime, execute natively on any Windows host, and present a smaller behavioral signature than compiled malware.
Attribution. APT28, per Insikt Group. APT28 (also tracked as Fancy Bear, Forest Blizzard, STRONTIUM) is assessed with high confidence by Western intelligence agencies to operate under Russia’s GRU military intelligence directorate. Confidence on this specific attribution: assessed moderate-to-high, based on Insikt Group’s technical analysis. Independent third-party verification not yet available in public reporting.
What Is Not Confirmed
No public statement from the governments of Romania, Spain, or Türkiye confirming compromise. HOOKEDGE’s full capability set, including persistence mechanisms, command-and-control infrastructure, and specific exfiltration targets, has not been detailed in public-facing disclosures.
Context
APT28 has a documented multi-decade history targeting European government and diplomatic infrastructure. The campaign timeline overlaps with ongoing Western disruption operations against nation-state espionage infrastructure targeting similar sectors. Government and diplomatic networks across Europe should treat this as confirmation that targeting pressure from multiple state actors remains active and coordinated.
The choice of a Windows batch script as the delivery mechanism is deliberate: it is not sophistication, it is operational economy. A batch script is harder to detect via traditional signature-based tools, requires no staging, and leaves fewer forensic artifacts than compiled implants when cleaned up carefully.
For Defenders
HOOKEDGE’s batch-script nature narrows the detection surface to a tractable set of signals:
- Windows Event Log process creation events (Event ID 4688 / Sysmon Event ID 1): look for
cmd.exespawning suspicious child processes, particularly those with network activity or writing to unusual paths. - Script block logging and PowerShell transcription if HOOKEDGE invokes any PowerShell as a child process.
- EDR behavioral coverage for batch-file execution with outbound network callbacks. Most modern EDR platforms should flag this pattern; verify it is tuned.
- Network-layer IOC detection: if Insikt Group’s technical appendix includes C2 infrastructure indicators, those are the fastest blocking opportunities. Pull them from Recorded Future’s platform directly.
Hunt for .bat files in user-writable directories and temporary paths, particularly those with recent creation dates and no corresponding installation event. APT28’s cleanup discipline is inconsistent; some artifacts remain.
Full technical indicators are available via Recorded Future’s research disclosure.
Found this useful? Share it.
