HOOKEDGE: How a State Actor Ran Six Months of Espionage on Batch Scripts, webhook.site, and Headless Edge

The short version//

The zine angle on this one is how little you need. Insikt Group's report on HOOKEDGE documents a Russian state-sponsored group running a six-month espionage campaign against European government and diplomatic organizations — and the entire command-and-control stack was: a Windows batch script, the free tier of webhook.site (a developer toy for testing HTTP requests), and Microsoft Edge in headless mode. No custom C2 binaries, no dedicated infrastructure, nothing paid.

If that doesn't make you rethink what your firewall allows, nothing will.

Who did it (and how confident are we?)//

Insikt Group assesses with moderate confidence that the campaigns were conducted by BlueDelta — a Russian state-sponsored group attributed to the GRU (Main Directorate of the General Staff), which overlaps with activity publicly tracked as APT28, Fancy Bear, and Forest Blizzard. That's Insikt's attribution language; don't flatten it into "the GRU did X" in your own notes. The basis: significant code and tradecraft overlap between HOOKEDGE and BlueDelta's earlier HEADLACE backdoor (documented by the same team in 2023), consistent infrastructure patterns, and targeting aligned with known Russian collection priorities.

The campaigns ran late September 2025 through early April 2026, hitting government ministries, diplomatic missions, and defense manufacturers in Romania, Spain, and Türkiye. Lab52 independently tracked the same activity under the name Operation MacroMaze — same campaign, different label, not a separate incident.

The lures: fake ministry agendas and "Enable Content" prompts//

Delivery was classic spearphish: macro-enabled Word documents. The earliest identified lure (first seen Sep 26, 2025) impersonated a meeting agenda from Spain's Ministry of the Presidency, Justice and Relations with the Cortes — created shortly after that ministry's real September 8 meeting with Moldovan officials, ahead of Moldova's September 2025 parliamentary elections. Diplomatic timing as social engineering.

Between October and December 2025 the group dropped the bespoke lures for generic ones: junk data or a prompt telling recipients to click "Enable Content" to view the document — Insikt assesses these likely targeted Romanian institutions during that window. After macros ran, victims got a fake Microsoft Word error dialog designed to discourage further scrutiny of the file they'd just infected themselves with. By early April 2026, network telemetry showed variants hitting Turkish organizations.

HOOKEDGE: the whole implant is a .bat file//

When the victim enables content, the document's AutoOpen() subroutine fires and drops six files into %userprofile% — all named after GUIDs of the attacker's webhook endpoints (a design choice that ties infrastructure to filenames):

File	Role
<guid>.bat	HOOKEDGE itself
<guid>.vbs	HOOKEDGE launcher
<guid>.cmd	Installer
<other-guid>.vbs	Installer launcher (named for the exfiltration webhook)
<guid>.htm	Exfiltration staging (header)
<guid>.xhtml	Exfiltration staging (footer)

The installer creates a scheduled task that runs every 30 minutes, launching the HOOKEDGE launcher with the payload as its argument — then the whole installer chain deletes itself, wiping the primary installation artifacts from disk. The document also contains a hidden image referencing a remote webhook (hxxp://webhook[.]site/<guid>/docopened.jpg) that acts as a canary: BlueDelta's operators get pinged the moment a victim opens the lure, before any macro runs. Later variants added mailopened.jpg canaries to track email opens too — essentially marketing-funnel analytics for phishing.

Each beacon cycle is a polling loop:

1. A scheduled task fires (every 30 minutes at first stage).
2. msedge.exe issues an HTTP request to the staging webhook, which returns HTML with JavaScript that downloads one or more .75e files into %userprofile%\Downloads.
3. The batch script concatenates them into a .cmd, executes it, and captures output.
4. Output gets wrapped between the pre-staged .htm header and .xhtml footer into an HTML page whose form auto-submits — a second Edge instance opens the file and POSTs the command output to the exfiltration webhook.
5. All temp files are deleted; any process with a matching window title gets killed.

The clever part is step 2: by generating traffic through a legitimate web browser instead of a custom binary or LOLBin, HOOKEDGE's C2 blends into normal enterprise browsing. Domain reputation, static blocklists, and TLS inspection policies that exempt trusted services all miss it — because the destination is a trusted service.

The free-tier cap that shaped the whole operation//

webhook.site's free tier caps at 100 requests per unique endpoint. At a 30-minute beacon interval, that exhausts an endpoint in roughly two to three days. Insikt assesses this single constraint drove two of HOOKEDGE's most important design decisions:

• Beacon intervals were stretched across revisions — observed variants used anything from 20 minutes up to a first-stage maximum of 61 minutes. The move past 60 minutes likely also beat automated sandboxes, which typically watch execution for about an hour.
• A two-tier tasking model: victims assessed as higher intelligence value got a second HOOKEDGE payload with its own scheduled task beacons every 5 minutes against dedicated webhook endpoints — faster interactive control for the interesting targets, while routine initial-access infrastructure kept running on its slower cadence without burning through quotas.

The implant was refined across six revisions between September 2025 and late June 2026 (lure changes, headless→hidden-window Edge execution in December 2025, canary filename changes, VBA obfuscation tweaks — and by July 2026 the document-open canary was dropped entirely). No new capabilities were added; every change was about evasion and infrastructure resilience. That's a mature operator polishing tradecraft, not experimenting.

What you should do//

1. Block macros from internet-originated documents — this is the single highest-value control here. Microsoft's recommended macro-blocking policy (disabling macros for docs that arrived via email/web) stops HOOKEDGE before AutoOpen() ever runs.
2. Watch scheduled-task creation. Insikt's specific detection: tasks executing scripts, batch files, or interpreters (wscript.exe, cscript.exe, cmd.exe, powershell.exe) from user-writable directories. HOOKEDGE relies on scheduled tasks for persistence in every observed variant.
3. Flag headless/hidden Edge. Unusual msedge.exe execution with --headless=new, local HTML files, or data URLs is rare in most environments and was the tasking/exfil transport here.
4. Audit outbound to webhook/file-hosting services. If nobody on your network legitimately uses webhook.site (or similar dev-webhook platforms), block it egress entirely. The report's IOC list publishes ~30 specific webhook.site UUIDs worth checking against your proxy logs.
5. Phishing-resistant MFA for email, VPN, and anything externally reachable — HOOKEDGE is initial access; BlueDelta historically leans on credential theft to expand from there, and a batch script can't stop a FIDO2 key.