APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batch script that's distributed via

Recorded Future Insikt Group reports that APT28 is using a new HOOKEDGE backdoor, delivered as a lightweight Windows batch script, in campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye between late 2025 and early 2026. The article describes a traditional cyber-espionage operation, not AI-specific tooling, but such persistent, state-linked access to government networks can indirectly threaten AI systems that depend on these environments and their data. From a RealGround perspective, this underscores the need to treat AI systems as part of a broader digital supply chain: compromise of underlying endpoints, servers, or data repositories can cascade into AI model poisoning, unauthorized model access, or manipulation of AI-driven workflows. Organizations deploying AI in sensitive government or diplomatic contexts should inventory where AI workloads run, include them in SBOM and supply chain risk management, and regularly red-team AI components against scenarios where an advanced adversary already has footholds in the surrounding infrastructure.