HOOKEDGE: A New Backdoor Aimed at European Government Networks, With Fingerprints Pointing to Russia

Key points

• Recorded Future's Insikt Group says a new backdoor called HOOKEDGE has been used against government and diplomatic targets in Romania, Spain and Türkiye between late September 2025 and early April 2026.
• HOOKEDGE is a small Windows batch script, meaning a simple text file of commands, that gives the attackers quiet remote access to infected machines.
• Researchers tie the activity, with medium confidence, to the Russian state-linked group tracked as APT28 (also called Fancy Bear or Sofacy by different vendors).
• The campaigns hit foreign ministries and diplomatic bodies, the classic target set for Russian military intelligence collection.
• No public victim count has been released, and the initial delivery method has not been fully detailed.

A new backdoor is quietly making the rounds inside European government networks, and analysts think Moscow is behind it.

Recorded Future's Insikt Group has published research on a piece of malware it calls HOOKEDGE. The tool has turned up on systems belonging to government and diplomatic organisations in Romania, Spain and Türkiye between late September 2025 and early April 2026.

HOOKEDGE isn't flashy. It's a Windows batch script, a plain text file full of commands the computer runs in sequence. That simplicity is the point. Small scripts are harder to spot and easier to alter than the noisier programs most security tools are trained to catch. Once on a machine, the script opens a quiet channel back to the attackers so they can issue commands and pull information out.

Who is behind it?

Insikt Group links the campaigns, with medium confidence, to APT28, the Russian state-sponsored group most vendors place inside Russia's military intelligence service, the GRU. Different companies use different names for the same crew: CrowdStrike calls it Fancy Bear, Microsoft tracks it as Forest Blizzard, Mandiant uses APT28.

Medium confidence matters here. It means the analysts see overlapping infrastructure and tradecraft with past APT28 operations, but they're not calling it definitive. Attribution in this space rarely is. Groups share tools, copy techniques, and sometimes plant deliberate false flags.

What isn't in dispute is the target set. Foreign ministries and diplomatic offices are precisely the kind of collection targets Russian intelligence has pursued for more than a decade. New Zealand named 33 Russia-linked cyber operators in sanctions last month, a move our coverage noted sits at the intersection of digital warfare and human-rights accountability.

What was targeted, and when?

All three countries sit on NATO's southern and eastern flank and handle sensitive diplomatic traffic on Ukraine, Black Sea security and energy supply. That's the material Russian intelligence has openly prioritised.

The reporting, first published by The Hacker News based on Insikt Group's findings, doesn't yet spell out the exact initial access route. In previous APT28 campaigns the group has favoured phishing emails, fake messages designed to trick staff into opening a booby-trapped file or handing over credentials. Whether HOOKEDGE arrives the same way isn't confirmed.

Should ordinary people worry?

Not directly. This is espionage, not a consumer scam. The attackers want cables and memos inside government buildings, not a shopper's bank details in Madrid or a teacher's in Bucharest.

The wider point is more unsettling. A tiny batch script, well hidden, sat inside diplomatic networks across three countries for months. The hard problem in defence still isn't exotic zero-days, meaning secret software flaws nobody's patched. It's patient operators using simple tools that blend into ordinary Windows activity. Defenders should watch for that pattern before they watch for the next novel implant.

Expect more detail as other vendors publish their own tracking under their own names.