APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Cybersecurity researchers have identified a series of campaigns targeting government and diplomatic organizations in several European countries, including Romania, Spain, and Türkiye. These campaigns occurred between late September 2025 and early April 2026. The attacks resulted in the deployment of a newly discovered backdoor called HOOKEDGE. HOOKEDGE is a lightweight backdoor that consists of a Windows batch script. It is being distributed via an unspecified method. The backdoor has been linked to APT28, a known threat actor.