New Russian Backdoor ‘HOOKEDGE’ Targets Diplomatic and Defense Networks in Europe

Security researchers have identified a fresh Windows-based backdoor, dubbed HOOKEDGE, being deployed by Russian cyber actors in a series of espionage campaigns aimed at diplomatic, governmental and defence‑related entities across Europe.

The malicious code appears to be delivered through seemingly benign Microsoft Word documents that, when opened, execute a hidden payload. Once installed, HOOKEDGE provides the attackers with persistent remote access, allowing them to exfiltrate documents, monitor communications and move laterally within compromised networks.

Investigations point to a concentration of activity in Romania, Spain and Turkey, where a range of ministries, embassies and defence contractors reported unusual network behaviour. Although the full extent of data harvested remains unclear, the intrusion of such sensitive institutions raises concerns about the potential leakage of classified diplomatic correspondence and strategic defence information.

HO​OKEDGE joins a growing toolbox of Russian‑linked malware that has been observed in recent years, including the notorious NotPetya ransomware and the more recent Inception framework. Analysts note that the use of a Word‑based delivery vector reflects a continued reliance on social engineering tactics, exploiting the trust users place in everyday office documents to bypass traditional security controls.

National cyber‑security agencies across the affected nations have issued alerts urging organisations to review their email filtering, enforce macro‑blocking policies and apply the latest security patches to Microsoft Office suites. Experts suggest that heightened vigilance and coordinated information‑sharing among European allies will be essential to mitigate further incursions and to track the evolution of the HOOKEDGE platform.