[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f55lNmpnnGAXNcyZInx-e9Lbglm4aBKF8z9H9d5gJTQI":3},{"article":4,"iocs":55,"watch_terms":78,"solutions":79,"lesson":168},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0f6f9bc4-e834-47b2-ba86-7cd139a6d791","APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations","apt28-linked-hookedge-backdoor-targets-european-government-and-diplomatic-organi-274019","Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batch script that's distributed via","Cybersecurity researchers have identified new campaigns by APT28 targeting European government and diplomatic entities in Romania, Spain, and Türkiye. These campaigns deploy a new backdoor called HOOKEDGE, distributed via malicious Word documents. The backdoor uses webhook.site for command and control, mimicking legitimate traffic and evading detection.","APT28 linked HOOKEDGE backdoor targets European government and diplomatic organizations.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fapt28-linked-hookedge-backdoor-targets.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjhjJnzm1UIfq8P7glIadtS8dGFvdsASot4sviMtZtFwpKL5B_2upZBcjMdYEBDcSnGmxpKP5LPUQ4XTpao-qCCbe6hQYF9qQBF7bhcPcZJkaz8KY9CCaKBRe-iu3ovbkZWjjtWEs_XJ9hl7D9ZRdKK9LqJynEh9XQ_7o8HZGi572pfnKyt3Yznk1QA311_\u002Fs1600\u002Feu-meeting.jpg","2026-08-28T08:20:59+00:00","2026-08-28T10:00:14.91502+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"APT28","threat_actor",{"name":21,"type":19},"Fancy Bear",{"name":23,"type":19},"Forest Blizzard",{"name":25,"type":26},"HOOKEDGE","product",{"name":28,"type":26},"HEADLACE",{"name":30,"type":31},"Recorded Future","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,58,62,66,69,72,75],{"type":49,"value":25,"context":57},"Previously undocumented backdoor deployed by APT28.",{"type":59,"value":60,"context":61},"domain","webhook.site","Used for command-and-control (C2), payload staging, and data exfiltration.",{"type":63,"value":64,"context":65},"mitre_attack","T1059.003","Execution of batch scripts.",{"type":63,"value":67,"context":68},"T1547.001","Scheduled task creation for persistence.",{"type":63,"value":70,"context":71},"T1071.001","Web Protocols for C2 communication (HTTP).",{"type":63,"value":73,"context":74},"T1041","Exfiltration Over C2 Channel.",{"type":63,"value":76,"context":77},"T1105","Ingress Tool Transfer (downloading second-stage payload).",[30,25,28],{"controls":80,"vendors":162},[81,107,133],{"slug":82,"name":83,"problem":84,"products":85},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[86,94,99],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":95,"product_name":96,"url":97,"description":98},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":108,"name":109,"problem":110,"products":111},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[112,120,125],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":121,"product_name":122,"url":123,"description":124},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":134,"name":135,"problem":136,"products":137},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[138,146,154],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[163],{"slug":164,"name":30,"logo_path":165,"roles":166},"recorded-future","\u002Fvendor-logos\u002Frecorded-future.png",[167],"reported_by",{"slug":169,"title":170,"body":171,"framework_refs":172,"framework_notes":184},"apt28-deploys-hookedge-backdoor-via-malicious-word-documents-against-european-governments","APT28 Deploys HOOKEDGE Backdoor via Malicious Word Documents Against European Governments","APT28, a Russian state-sponsored threat actor, is targeting European government and diplomatic organizations by weaponizing Microsoft Word documents to deliver the HOOKEDGE backdoor. The malware leverages webhook.site — a legitimate web service — for command-and-control communication, effectively blending malicious traffic with normal web activity and bypassing traditional detection tools. This campaign highlights the danger of trusting seemingly legitimate file attachments and the difficulty of detecting threats that abuse trusted third-party services. Without robust email filtering, user awareness, and behavioral monitoring, such campaigns can persist undetected for extended periods, giving adversaries deep access to sensitive government networks.",[173,174,175,176,177,178,179,180,181,182,183],"CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","CIS Control 2 – Inventory and Control of Software Assets","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AT-2 – Security Awareness Training","NIST SP 800-61 – Incident Response","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment","MITRE ATT&CK T1071.001 – Application Layer Protocol: Web Protocols","GDPR Article 32 – Security of Processing","ITIL – Threat and Risk Management",{}]