An agenda for a meeting pops up, seemingly from a government ministry. This document prompts the user to allow content. Once they do, six files silently find themselves deposited in their user directory. Thirty minutes later, Microsoft Edge opens, makes one request to the internet, and then closes down. There is nothing unusual about this traffic; the browser is actually just making a normal outbound connection.
What is HOOKEDGE? HOOKEDGE is a Windows backdoor built completely out of a batch file, which with moderate certainty is attributed to the Russian government-backed hacking group APT28. It does not connect to any server controlled by the attackers. Instead, it gets Microsoft Edge to pull down commands from webhook.site, a free website developers use for testing HTTP calls.
A Backdoor With No Executable
The attack begins with spearphishing, in which macro-enabled Word documents contain diplomatic enticements, and enabling macros executes an AutoOpen() function which deposits six files in the %userprofile% directory.
These files perform specific jobs. One file is the backdoor, which is executed by a VBS file and installed by a CMD file which is launched by another VBS file, while two web page files await any data to be stolen.
Once the persistence is established, the installer deletes itself and its VBS launcher, along with the task created to launch it.
What is noteworthy about the entire operation? Nothing there is compiled in any way; there is not even any binary code anywhere. All scripts run in a scripting engine and in one browser which comes pre-installed with the operating system.
How A Testing Service Becomes A Dead Drop
webhook.site allows developers to connect an application to a URL to determine what is coming through it. The individuals operate the tool entirely in the free package for the entire command channel with different endpoints for different tasks.
Every polling cycle involves, clearing the Downloads folder, launching Edge to a staging URL, obtaining the command file fragment, assembling and executing them and collecting the output.
Exfiltration does the opposite by wrapping the captured output into a pre-staged header/ footer making it a legitimate page. Another instance of Edge loads the page automatically and submits it to a new endpoint. The temporary files are deleted while any process that matches the task window title is killed.
The early versions of Edge ran headless while the recent versions used hidden windows to make it appear legitimate.
They also included a canary; hidden images in the lures were pointing to their webhooks. Opening the document indicated the bait was picked before running the code.
Slower On Purpose
Beaconing intervals in this campaign are worth studying, because they were tuned rather than chosen casually.
First-stage implants checked in every 30 minutes. Targets judged more valuable received a second-stage variant beaconing as often as every five minutes, which let operators work interactively when it mattered.
Later variants went the other direction and stretched the interval to 61 minutes. That number is not arbitrary. Automated analysis sandboxes commonly watch a sample for about an hour. A backdoor that waits 61 minutes before acting therefore shows such a sandbox precisely nothing.
There is a second benefit for the operators. The free tier caps each endpoint at 100 requests, and a quiet implant burns through that budget far more slowly.
Ministries In Three Countries
Government and diplomatic organizations in Romania, Spain, and Türkiye were the targets. The campaign ran from late September 2025 into April 2026.
One lure is unusually revealing. It posed as a meeting agenda from a Spanish ministry, and it was built on September 26, 2025. That ministry had genuinely met with Moldovan officials earlier the same month. The timing points to collection interest around Moldova’s September 2025 parliamentary elections rather than opportunistic phishing.
Later documents abandoned that specificity. They displayed fake Microsoft Word error dialogs instead, discouraging the recipient from looking too closely at what had just happened.
Attribution rests on moderate confidence. It draws on substantial code overlap with HEADLACE, a batch-based backdoor the same group has used since 2023. Consistent infrastructure habits and targeting that matches Russian intelligence priorities support the assessment further. We have examined Russian state-linked espionage tradecraft in the FSB Center 16 router campaign.
Nothing To Block, Nothing To Detect
The defensive dilemma is clear, blocking this domain would impact the operations of a service that thousands of software developers use daily. The network client for the service is Microsoft Edge which no organization blocks. The malware is also a batch file common to all computers.
Reputation, signature and domain information approaches fail to detect this. The traffic starts from a trusted application, uses HTTPs, and connects to a service with good reputation. Behavioral analysis does not detect it because the least abnormal event on a workstation is a browser making HTTP requests.
And the design’s weakness is the first assumption unverified script needs to execute. Execution Governance detects this action point in time. Unlike other defensive measures that look for suspicious behavior, execution governance looks at the trust of the code. Unverified batch file, sent via macro in Word, does not have a trust verdict, thus it executes in Kernel API Virtualization regardless of the legitimacy of the courier.
Once the chain is established, everything else fails. Files are virtualized, registry changes are sandboxed. Staging files, scheduled task and exfiltration page are never seen on the host.
Conclusion: The Browser Was Trusted. The Execution Was Not.
The defining lesson from HOOKEDGE is not that Microsoft Edge became malicious. It is that attackers can make legitimate software perform the network activity their backdoor needs while keeping the actual implant remarkably simple.
The chain begins with spearphishing and a macro-enabled Word document. Once the recipient enables content, scripts establish the backdoor and scheduled persistence. HOOKEDGE then uses Microsoft Edge to retrieve attacker commands from webhook.site, execute them locally, collect the results, and send them back through the same legitimate service. The browser is genuine. The web service is genuine. The batch interpreter is native to Windows. None of those facts establish that the execution they are facilitating is authorized.
That distinction is the defensive center of this campaign. Reputation and domain-based controls become less decisive when traffic originates from a legitimate browser and reaches infrastructure that has legitimate developer use. The stronger control point appears earlier, when unverified scripts and attacker-supplied command fragments attempt to gain execution rights on the endpoint.
Why This Threat Matters
- The backdoor does not need a custom executable. Batch, VBS, CMD, HTML, scheduled tasks, and a pre-installed browser are enough to create a durable command channel.
- Legitimate infrastructure reduces obvious network indicators. Blocking a broadly used development service or Microsoft Edge outright is operationally unrealistic.
- Trusted process names do not establish trusted intent.
msedge.execan perform perfectly legitimate HTTP requests on behalf of an attacker-directed workflow. - Persistence is intentionally quiet. Beacon intervals of 30 minutes, five minutes for selected targets, and later 61 minutes show deliberate adaptation to operational needs and analysis windows.
- User interaction is part of initial access. The malicious chain depends on the recipient accepting the lure and enabling active content.
- Attribution remains an assessment. Tradecraft, targeting, and overlap with HEADLACE support the APT28 link, but the stated confidence level should be preserved.
Where Defensive Control Must Operate
Defense must operate before trusted applications become couriers for untrusted execution.
Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform applies Execution Governance to unknown scripts and execution chains before trust exists. The relevant question is not whether Edge, Word, or cmd.exe is legitimate, but whether the code and commands they are being asked to execute have earned unrestricted runtime rights.
Xcitium Cyber Awareness Education and Phishing Simulation address the human entry point by training users to distrust unexpected macro-enabled documents, diplomatic or organizational lures, and prompts to enable active content.
Trust the Code, Not Its Courier
Security teams should investigate Office-triggered script execution, scheduled tasks created from user-writable locations, unusual hidden or headless browser activity, and unexpected browser connections to developer-oriented webhook services as a behavioral chain rather than isolated events.
HOOKEDGE succeeds by borrowing trust from everything around it. The defensive response is to stop inherited trust at the execution boundary.
