HOOKEDGE Batch Backdoor Refines HEADLACE Tradecraft via webhook.site Limits and Scheduled Task Self-Deletion
HOOKEDGE represents an incremental evolution of APT28's HEADLACE backdoor, leveraging webhook.site for low-infrastructure C2 while minimizing forensic traces through self-deletion. Attribution rests on code overlap and tradecraft continuity rather than independent infrastructure confirmation. Future operations will likely pivot C2 methods as service limits tighten.
The implant chain writes six files to %userprofile%, creates a 30-minute scheduled task, then purges the launcher, definition, and itself to shrink forensic residue. A hidden image in the lure pings a webhook on open for operator notification. Second-stage variants shift high-value targets to dedicated endpoints with five-minute beacons to bypass the 100-request free-tier cap, separating access from collection infrastructure.
Code and C2 overlap with HEADLACE, including webhook.site abuse since April 2023, underpins the moderate-confidence BlueDelta attribution. Technical artifacts—batch polling loops, Edge invocation patterns, and sandbox-evasion tweaks—match observed Russian state tradecraft more closely than the public attribution statement alone. Independent verification of infrastructure reuse remains limited to the single service provider.
The pattern shows sustained adaptation to API constraints and detection tools rather than novel capability. Expect continued migration to alternative webhook or legitimate SaaS services as free-tier thresholds change, with targeting focused on entities handling NATO or EU diplomatic traffic.
Recorded Future: BlueDelta will switch at least 40 percent of active HOOKEDGE endpoints to non-webhook C2 within 90 days of any webhook.site free-tier reduction below 50 requests.
Sources (3)
- [1]Recorded Future Insikt Group Analysis(https://go.recordedfuture.com/insikt-hookedge-blue-delta)
- [2]The Hacker News Coverage(https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html)
- [3]Microsoft Threat Intelligence on HEADLACE(https://www.microsoft.com/security/blog/2024/04/forest-blizzard-headlace/)