A new set of campaigns linked to APT28 (Fancy Bear) has been observed targeting government and diplomatic organizations in Romania, Spain, and Türkiye. These attacks, occurring between late September 2025 and early April 2026, deploy a previously undocumented backdoor named HOOKEDGE. The lightweight Windows batch script is distributed via spear-phishing, indicating persistent nation-state espionage efforts.