CTI · corroborated · 2026-09-05

Russian Hackers Deploy New HOOKEDGE Backdoor in Espionage Attacks Across Europe

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1053 Scheduled Task/Job Execution
• T1070 Indicator Removal Stealth
• T1027 Obfuscated Files or Information Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: APT28 HOOKEDGE Backdoor Macro-Enabled Word Execution
id: a7b3e8c1-4d2f-49a6-b5c8-3e1f7a2d9b04
status: experimental
description: >
    Detects the HOOKEDGE backdoor delivery chain attributed to APT28 / BlueDelta.
    Attackers use spearphishing attachments containing macro-enabled Word documents
    that trigger AutoOpen(), drop batch/cmd/vbs/html files into the user profile
    directory, and create a scheduled task for persistence. This rule detects the
    initial macro execution via wmiprocessor/wmic or mshta followed by scheduled
    task creation patterns associated with HOOKEDGE installation.
references:
    - https://gbhackers.com
    - https://cyberpress.org
author: Tia N. List
date: 2026/09/05
tags:
    - attack.t1566
    - attack.t1059
    - attack.t1053
logsource:
    category: process_creation
    product: windows
detection:
    selection_word_macro:
        Image|endswith:
            - '\WINWORD.EXE'
            - '\EXCEL.EXE'
        CommandLine|contains|all:
            - '/t'
            - '.doc'
    selection_scheduled_task_create:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - '/create'
            - '/tn'
    selection_wscript_vbs:
        Image|endswith: '\wscript.exe'
        CommandLine|endswith:
            - '.vbs'
            - '.vbs"'
    selection_mshta_html:
        Image|endswith: '\mshta.exe'
        CommandLine|contains:
            - '.html'
            - '.xhtml'
            - '.hta'
    condition: 1 of selection_*
falsepositives:
    - Legitimate macro-enabled documents opened by users
    - Scheduled task creation by administrators
    - VBScript execution for IT administration
    - HTA files used in enterprise application deployment
level: high

References

• https://gbhackers.com
• https://cyberpress.org