APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

APT28, a Russian state-sponsored threat actor, is targeting European government and diplomatic organizations by weaponizing Microsoft Word documents to deliver the HOOKEDGE backdoor. The malware leverages webhook.site — a legitimate web service — for command-and-control communication, effectively blending malicious traffic with normal web activity and bypassing traditional detection tools. This campaign highlights the danger of trusting seemingly legitimate file attachments and the difficulty of detecting threats that abuse trusted third-party services. Without robust email filtering, user awareness, and behavioral monitoring, such campaigns can persist undetected for extended periods, giving adversaries deep access to sensitive government networks.