Russian military intelligence unit GRU's cyber operations division tracked as APT28 has deployed a previously unknown backdoor called HOOKEDGE against European government and diplomatic targets. Security researchers at Recorded Future's Insikt Group identified the malware in active campaigns spanning late September 2025 through early April 2026, with confirmed infections across Romania, Spain, and Türkiye.
HOOKEDGE operates as a lightweight Windows batch script, a deliberate choice that reflects APT28's preference for simple, fileless persistence mechanisms that evade traditional antivirus detection. Batch scripts leave minimal forensic artifacts and blend into legitimate system activity, making them particularly effective for maintaining long-term access to sensitive government networks. The backdoor's simplicity belies its operational effectiveness. APT28 operators use it to establish persistent command-and-control channels, execute arbitrary commands, and harvest credentials from compromised systems.
The targeting pattern reflects Moscow's intelligence priorities in Eastern Europe. Romania hosts NATO infrastructure and serves as a staging ground for Western military assistance to Ukraine. Spain houses NATO command facilities and coordinates Mediterranean security operations. Türkiye sits at the intersection of NATO, Middle East, and Russian sphere-of-influence politics, making its diplomatic cables invaluable for intelligence purposes. The diplomatic angle indicates APT28's focus on capturing classified communications, negotiating positions, and intelligence assessments from government ministries.
APT28, formally designated GRU Main Directorate, operates under Russia's 20th Main Directorate. The unit maintains a decades-long track record of espionage operations targeting NATO members, political parties, and defense contractors. Previous operations attributed to APT28 include the 2016 Democratic National Committee breach, intrusions against Ukrainian government systems, and sustained campaigns against NATO defense ministries.
Recorded Future's analysis suggests HOOKEDGE campaigns likely used spear-phishing emails or watering hole attacks to achieve initial access. The malware's batch script nature indicates delivery through secondary-stage payloads following initial exploitation. Victims probably downloaded HOOKEDGE after clicking malicious links or opening weaponized attachments that exploited known Windows vulnerabilities or Social engineering techniques.
The backdoor's discovery matters because it signals APT28's continued operational tempo against European targets despite international sanctions and NATO's enhanced cyber defenses. Lightweight scripting-based malware represents an evolution in tradecraft. APT28 operators recognize that detection tools focus on binary executables and .NET assemblies, so batch scripts slip through gaps in security monitoring. Organizations relying solely on signature-based detection or endpoint protection engines focused on compiled malware face heightened risk.
European governments should assume compromise of diplomatic channels, intelligence assessments, and NATO planning documents from affected ministries. The backdoor's persistence mechanism likely enables long-term access. Threat actors can harvest passwords, cryptocurrency wallets, encryption keys, and classified documents continuously over months or years. Recovery requires complete network forensics, secure credential rotation across all systems, and network segmentation to prevent lateral movement.
Organizations in NATO member states should prioritize detection of batch script execution anomalies, monitor for unexpected network outbound connections from government systems, and implement network segmentation isolating diplomatic networks from general IT infrastructure. Endpoint detection and response platforms must flag unusual batch script activity and command-line executions. Network defenders should hunt for HOOKEDGE indicators of compromise shared by Recorded Future and cross-reference those signatures with their own logs spanning the past six months.