New Cyber Attacks on European Governments

Cybersecurity researchers have identified a new wave of cyberattacks on government and diplomatic organizations in Europe. These attacks, which took place between the end of September 2025 and early April 2026, particularly affect institutions in Romania, Spain, and Türkiye. The Insikt Group from Recorded Future has investigated the campaigns and discovered a novel backdoor named HOOKEDGE.

HOOKEDGE is a lightweight Windows batch script used by the attackers to gain unauthorized access to the target systems. The spread of this backdoor occurs through various methods that allow the attackers to bypass the security measures of the affected organizations. However, the exact method of dissemination has not been detailed.

Details of the Attacks

The attacks appear to be well-planned and targeted, suggesting that the attackers have extensive information about their targets. The affected organizations are primarily government agencies and diplomatic missions, which increases the sensitivity of the attacks. Researchers from Recorded Future have noted that the attacks were carried out in multiple waves, indicating a coordinated strategy.

The use of HOOKEDGE as a backdoor is particularly concerning, as it allows the attackers to infiltrate the systems unnoticed and potentially steal confidential information. Researchers have also found that the backdoor is capable of executing various commands that help the attackers solidify their control over the systems.

The identification of HOOKEDGE is an important step in the fight against cybercrime, as it enables security authorities to take targeted actions. Researchers recommend that affected organizations review and strengthen their security protocols to protect against such attacks. The discovery of this backdoor could also lead to the development of further security solutions to combat similar threats.

Reactions to the Attacks

The reactions to the attacks have been mixed, with some governments taking immediate action to secure their systems. In Romania, for example, emergency plans were activated to ensure the integrity of government data. In Spain and Türkiye, authorities have also become active in analyzing the threat and taking appropriate countermeasures.

The international community has condemned the attacks and emphasized the importance of strengthening cooperation in the field of cybersecurity. Experts warn that such attacks on government organizations not only jeopardize national security interests but can also undermine citizens' trust in their governments. The incidents have reignited the discussion about the need for stronger cyber defense in Europe.

The discovery of HOOKEDGE and the associated attacks highlight the ongoing threat posed by state-sponsored hacker groups. These groups are increasingly using sophisticated techniques to achieve their goals, and the need to prepare against such threats is becoming more urgent. Researchers from Recorded Future have emphasized that the development of new security solutions and training employees in cybersecurity are crucial to preventing future attacks.