Russia's APT28 hides its spy traffic in a free web tool

Every time a European diplomat opened one particular Word attachment, a hidden image tried to load. It pointed at hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. The picture did not matter. The request did. It arrived at an endpoint on a free public web service, carrying the reader's IP address, and it told a Russian intelligence operator that the letter had been opened.

The spies knew the document had been read before any malware had run.

That canary is one small piece of a campaign Recorded Future's Insikt Group published on 27 August, covering initial access operations run between late September 2025 and early April 2026 against government, diplomatic and defense manufacturing organizations in Romania, Spain and Türkiye. The team assesses with moderate confidence that the operator is BlueDelta, the group more widely tracked as APT28, Fancy Bear and Forest Blizzard, and attributed to Russia's military intelligence service, the GRU. The original report names the payload HOOKEDGE.

What makes it worth reading is not the malware, which is a batch script. It is the infrastructure. HOOKEDGE has no command server, no registered domain and no hosting of its own. It runs entirely on webhook[.]site, a free public service for inspecting HTTP requests, and it talks to it through Microsoft Edge. There is nothing on the wire for a reputation engine to object to.

A meeting agenda that arrived too fast

The earliest lure Insikt Group identified was first seen on 26 September 2025. It presented itself as a 15 September meeting agenda from Spain's Ministry of the Presidency, Justice and Relations with the Cortes. The researchers could not verify the document's authenticity, and note that BlueDelta has historically recycled genuine government material, including publicly available material, into its lures.

The timing is the part worth pausing on. The ministry had met Moldovan officials on 8 September 2025, and Moldova held parliamentary elections later that month. Insikt Group suggests the lure may reflect an effort to collect against legitimate diplomatic activity of interest to Moscow at exactly the moment it was of interest. That is a judgment about intent, offered as a possibility rather than a finding, and it should be read that way.

Between October and December 2025 the diplomatic dressing came off. Later documents showed recipients either junk data or a bare prompt to click Enable Content, and once macros ran, a fake Microsoft Word error message appeared to discourage a second look. Insikt Group reads the shift as a sign the targeting broadened, most likely to institutions in Romania. By April 2026, network telemetry placed HOOKEDGE variants against organizations in Türkiye.

Six files, then none

Opening the document and enabling macros fires an AutoOpen() routine that writes six files into the user's profile directory and starts the installer chain. Five are named after the GUID of the webhook endpoint that will task the implant. The sixth, the installer launcher, carries the GUID of the endpoint that will receive stolen output. The naming is administrative convenience, and it ties the files on disk straight to the infrastructure.

The installer launcher registers a scheduled task that fires every 30 minutes and hands the HOOKEDGE payload to a small launcher script. Then it deletes itself, the installer, and the task definition file. Within moments of the compromise, the clearest evidence of how it happened is gone. Insikt Group reads the self-deletion as a deliberate effort to shrink the forensic footprint and complicate any later investigation.

The browser is the network stack

Each time the scheduled task fires, HOOKEDGE clears leftovers out of the Downloads folder, then asks Microsoft Edge to fetch its tasking endpoint. What comes back is HTML carrying JavaScript that quietly downloads one or more files with a .75e extension, named for the last three characters of the staging endpoint's GUID. The backdoor concatenates them into a .cmd file, runs it, and captures the output.

Exfiltration is the same trick in reverse. The output is wrapped between two files the installer pre-staged on disk, an .htm header and an .xhtml footer, producing a small HTML page. A second Edge instance opens it, a form submits itself on load, and the command output leaves as an ordinary HTTP POST to a second endpoint. Tasking and exfiltration never share an address.

Both halves are a legitimate browser talking to a legitimate HTTPS service. Domain reputation, static blocklists and TLS inspection policies that exempt trusted destinations all look at this and see nothing worth stopping.

A free quota that shapes the tradecraft

The constraint that shows most clearly in the tradecraft is not a defensive one. It is the service's free tier. Insikt Group notes that webhook[.]site caps a unique free endpoint at 100 requests, which a 30-minute beacon burns through in roughly two to three days.

Webhook.site's own documentation is blunter still. It records that a free URL "stops accepting new requests and emails after a limit of 100 requests or emails", and states separately that the URL and its data are removed automatically after seven days. So an endpoint dies twice over: once when the counter runs out, and once on a clock that runs whether the implant ever beacons or not. Every piece of infrastructure in this campaign had a maximum working life of a week from the moment it was created.

That is the pressure the two-stage design answers. Victims judged worth closer attention receive a second HOOKEDGE payload with its own scheduled task, its own endpoints, and a beacon interval as short as five minutes, quick enough for an operator to work interactively. Keeping that traffic off the initial-access endpoints stops one high-value target from consuming the quota that everybody else's first contact depends on. Insikt Group assesses with moderate confidence that the second payload is a deliberate triage step, with canary hits and successful endpoint contacts used to decide who gets it.

Tuned against the sandbox clock

The single change Insikt Group calls most significant is a timer. The first-stage beacon moved from 30 minutes to 61. Automated sandboxes commonly watch a sample for up to an hour, so an implant that stays quiet for 61 minutes is a sample that does nothing at all in the report. The same change slows quota consumption. One adjustment, two problems.

The rest of the timeline reads like maintenance. In December 2025 the Edge instance moved from headless to a hidden window. In January 2026 a second canary appeared, mailopened.jpg, giving operators a separate signal for the email being opened as distinct from the document. In April the document canary was renamed doc.jpg. In June it was dropped altogether, and Insikt Group does not claim to know why, offering only that it may be an attempt to reduce network indicators.

Underneath all of it, HOOKEDGE shares its core architecture, its scripting language, its use of hidden browser instances, and even variable names and base64 encoding schemes in its second-stage JavaScript with HEADLACE, the backdoor Insikt Group documented BlueDelta using in 2023. The assessment that HOOKEDGE is HEADLACE's successor, maintained by the same operators, is again offered at moderate confidence.

What the evidence carries, and what it does not

Worth being precise about the limits. The attribution to BlueDelta rests on code and tradecraft overlap with HEADLACE, consistent infrastructure patterns, and targeting that matches known Russian collection priorities, and Insikt Group states it at moderate confidence rather than as fact. The link between the Spanish lure and Moldova's elections is a timing observation, not evidence of tasking. Lab52 has reported similar activity under the name Operation MacroMaze, which corroborates the activity rather than the attribution. None of that weakens the technical account, which rests on samples and network telemetry. It does mean the GRU label carries exactly the confidence the researchers put on it, and no more.

Block the macros, then ask what Edge is fetching

Insikt Group's guidance starts where the chain does. Blocking macro execution in documents that came from the internet stops every variant in the report at step one. Beyond that, the team recommends phishing-resistant multi-factor authentication such as FIDO2 security keys or certificate-based authentication, detection coverage for scheduled task abuse and for automated or hidden Microsoft Edge execution, and blocking outbound traffic to webhook services the organization does not itself use. That last one is the awkward item, and it is the whole point of the campaign: this traffic only looks anomalous if you have already decided which legitimate services your estate is allowed to reach.

Indicators

Insikt Group publishes 31 webhook URLs and 26 sample hashes in full, alongside detection guidance.

We have written before about APT28 shifting toward disposable malware, and HOOKEDGE is that same instinct applied to infrastructure instead of code. A group with a decade of operations and a state budget behind it is running European espionage on a free tier, from endpoints that expire in a week, through a browser somebody else wrote and every one of its targets already trusts. The defensive question that follows is not which domains are malicious. It is which ordinary ones your machines have any business talking to at all.

This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.

Read the full analysis on IntelFusions