DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage

Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2 Grupo's LAB52 threat intelligence team. The campaign, observed in February 2026, has been assessed to share overlaps with a prior campaign mounted by Laundry Bear (aka UAC-0190 or Void Blizzard) aimed at Ukrainian defense forces with a malware family known as PLUGGYAPE. The attack activity employs various judicial and charity themed lures to deploy a JavaScript‑based backdoor that runs through the Edge browser. Codenamed DRILLAPP, the malware is capable of uploading and downloading files, leveraging the microphone, and capturing images through the webcam by taking advantage of the web browser's features. Two different versions of the campaign have been identified, with the first iteration detected in early February. The attack makes use of a Windows shortcut (LNK) file to create an HTML Application (HTA) in the temporary folder, which then loads a remote remote script hosted on Pastefy, a legitimate paste service. To establish persistence, the LNK files are copied to the Windows Startup folder so that they are automatically launched following a system reboot. The attack chain then displays a URL containing lures related to installing Starlink or a Ukrainian charity named Come Back Alive Foundation. The HTML file is eventually executed via the Microsoft Edge browser in headless mode, which then loads the remote obfuscated script hosted on Pastefy. The browser is executed with additional parameters like –no-sandbox, –disable-web-security, –allow-file-access-from-files, –use-fake-ui-for-media-stream, –auto-select-screen-capture-source=true, and –disable-user-media-security, granting it access to the local file system, as well as camera, microphone, and screen capture without requiring any user interaction. The artifact essentially functions as a lightweight backdoor to facilitate file system access and capture audio from the microphone, video from the camera, and images of the device's screen all through the browser. It also generates a device fingerprint using a technique called canvas fingerprinting when run for the first time and uses Pastefy as a dead drop resolver to fetch a WebSocket URL used for command‑and‑control (C2) communications. The malware transmits the device fingerprint data along with the victim's country, which is determined from the machine's time zone. It specifically checks if the time zones correspond to the U.K., Russia, Germany, France, China, Japan, the U.S., Brazil, India, Ukraine, Canada, Australia, Italy, Spain, and Poland. If that's not the case, it defaults to the U.S. The second version of the campaign, spotted in late February 2026, eschews LNK files for Windows Control Panel modules, while keeping the infection sequence largely intact. Another notable change involves the backdoor itself, which has now been upgraded to allow recursive file enumeration, batch file uploads, and arbitrary file download. "For security reasons, JavaScript does not allow the remote downloading of files," LAB52 said. "This is why the attackers use the Chrome DevTools Protocol (CDP), an internal protocol of Chromium‑based browsers that can only be used when the –remote-debugging-port parameter is enabled." It's believed that the backdoor is still in the initial stages of development. An early variant of the malware detected in the wild on January 28, 2026, has been observed just communicating with the domain "gnome[.]com" instead of downloading the primary payload from Pastefy. "One of the most notable aspects is the use of the browser to deploy a backdoor, which suggests that the attackers are exploring new ways to evade detection," the Spanish security vendor said. "The browser is advantageous for this type of activity because it is a common and generally non‑suspicious process, it offers extended capabilities accessible through debugging parameters that enable unsafe actions such as downloading remote files, and it provides legitimate access to sensitive resources such as the microphone, camera, or screen recording without triggering immediate alerts."

Ukrainian entities have become the target of a new campaign likely orchestrated by Russian-linked threat actors, according to a report from S2 Grupo's LAB52 threat intelligence team. The campaign, observed in February 2026, shares overlaps with a prior operation by Laundry Bear (also known as UAC-0190 or Void Blizzard) that targeted Ukrainian defense forces with the PLUGGYAPE malware family.

The attack uses judicial and charity-themed lures to deploy a JavaScript-based backdoor that runs through the Microsoft Edge browser. Dubbed DRILLAPP, the malware can upload and download files, access the microphone, and capture images via the webcam, leveraging the browser's features.

Two versions of the campaign have been identified. The first, detected in early February, uses a Windows shortcut (LNK) file to create an HTML Application (HTA) in the temporary folder, which then loads a remote script from Pastefy, a legitimate paste service. For persistence, the LNK file is copied to the Windows Startup folder, ensuring automatic execution after reboot. The attack chain displays a lure URL related to installing Starlink or the Ukrainian charity Come Back Alive Foundation. The HTML file is executed via Microsoft Edge in headless mode, loading the obfuscated script from Pastefy.

The browser runs with parameters such as --no-sandbox, --disable-web-security, --allow-file-access-from-files, --use-fake-ui-for-media-stream, --auto-select-screen-capture-source=true, and --disable-user-media-security, granting access to the local file system, camera, microphone, and screen capture without user interaction. The malware functions as a lightweight backdoor, enabling file system access, audio recording, video capture, and screen grabbing. It generates a device fingerprint using canvas fingerprinting and uses Pastefy as a dead drop resolver to retrieve a WebSocket URL for command-and-control (C2) communications.

The malware transmits the device fingerprint along with the victim's country, determined from the machine's time zone. It checks for time zones corresponding to the U.K., Russia, Germany, France, China, Japan, the U.S., Brazil, India, Ukraine, Canada, Australia, Italy, Spain, and Poland; otherwise, it defaults to the U.S.

The second version, spotted in late February 2026, replaces LNK files with Windows Control Panel modules while keeping the infection sequence largely unchanged. The backdoor has been upgraded to support recursive file enumeration, batch file uploads, and arbitrary file download. "For security reasons, JavaScript does not allow the remote downloading of files," LAB52 noted. "This is why the attackers use the Chrome DevTools Protocol (CDP), an internal protocol of Chromium-based browsers that can only be used when the --remote-debugging-port parameter is enabled."

The backdoor is believed to be in early development. An early variant detected on January 28, 2026, only communicated with the domain "gnome[.]com" instead of downloading the primary payload from Pastefy. "One of the most notable aspects is the use of the browser to deploy a backdoor, which suggests that the attackers are exploring new ways to evade detection," the Spanish security vendor said. "The browser is advantageous because it is a common, non-suspicious process, offers extended capabilities through debugging parameters that enable unsafe actions like downloading remote files, and provides legitimate access to sensitive resources such as the microphone, camera, or screen recording without triggering immediate alerts."