HOOKEDGE Backdoor Targets European Diplomats

Recorded Future linked HOOKEDGE, a Windows batch backdoor, to APT28 attacks on Romanian, Spanish, and Turkish government entities from late September 2025 to early April 2026. The malware spreads via macro-enabled Word documents and uses webhook[.]site for command-and-control, evolving from the HEADLACE backdoor.