APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batch script that's distributed via as-yet-unnamed initial access vectors. Recorded Future attributes the activity to APT28, a likely state-sponsored threat actor. The HOOKEDGE backdoor is described as a lightweight Windows batch script. Its exact distribution mechanism has not been publicly detailed, but researchers suspect spear-phishing or exploitation of public-facing services as likely vectors. Once executed, the script may execute commands or download additional payloads, providing unauthorized access to targeted networks. The campaigns targeted government and diplomatic entities in three countries. The geographic spread and focus on diplomatic organizations suggest intelligence-gathering objectives aligned with APT28's known espionage tradecraft. Recorded Future has not disclosed specific indicators of compromise or technical signatures, but has recommended monitoring for anomalous batch script execution and applying least-privilege principles. No specific patches or software updates address the HOOKEDGE backdoor, as it is a custom tool rather than an exploitation of an unpatched vulnerability. Authorities and security teams are advised to review network logs for signs of unauthorized batch script execution and to enforce strict application control policies.