APT28 HOOKEDGE Backdoor Hits European Gov/Diplomatic Targets

Fri, 28 Aug 2026 21:21:40 +0000

Engineer — Skip
SOC/IR — Act: APT28-linked HOOKEDGE is a new Windows batch-script backdoor actively used against government and diplomatic targets in Europe; hunt for suspicious batch-script persistence mechanisms and lateral movement patterns consistent with APT28 TTPs (ATT&CK: T1059.003) in Windows endpoint telemetry since September 2025.
Leader — Learn: APT28 has deployed a novel backdoor against European government and diplomatic organizations — relevant for sector-risk awareness and to brief leadership if your organization has European government ties or similar exposure profile.

Apt28 on CuraSec