DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage

Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2 Grupo's LAB52 threat intelligence team. The campaign, observed in February 2026, has been assessed to share overlaps with a prior campaign mounted by Laundry Bear (aka UAC-0190 or Void Blizzard) aimed at Ukrainian defense forces with a malware family known as PLUGGYAPE.

The attack activity "employs various judicial and charity themed lures to deploy a JavaScript‑based backdoor that runs through the Edge browser," the cybersecurity company said. Codenamed DRILLAPP, the malware is capable of uploading and downloading files, leveraging the microphone, and capturing images through the webcam by taking advantage of the web browser's features.

Two-Stage Campaign Evolution

Two different versions of the campaign have been identified, with the first iteration detected in early February by making use of a Windows shortcut (LNK) file to create an HTML Application (HTA) in the temporary folder, which then loads a remote script hosted on Pastefy, a legitimate paste service. To establish persistence, the LNK files are copied to the Windows Startup folder so that they are automatically launched following a system reboot.

The attack chain then displays a URL containing lures related to installing Starlink or a Ukrainian charity named Come Back Alive Foundation. The HTML file is eventually executed via the Microsoft Edge browser in headless mode, which then loads the remote obfuscated script hosted on Pastefy. The browser is executed with additional parameters like –no-sandbox, –disable-web-security, –allow-file-access-from-files, –use-fake-ui-for-media-stream, –auto-select-screen-capture-source=true, and –disable-user-media-security, granting it access to the local file system, as well as camera, microphone, and screen capture without requiring any user interaction.

Browser-Based Espionage Capabilities

The artifact essentially functions as a lightweight backdoor to facilitate file system access and capture audio from the microphone, video from the camera, and images of the device's screen all through the browser. It also generates a device fingerprint using a technique called canvas fingerprinting when run for the first time and uses Pastefy as a dead drop resolver to fetch a WebSocket URL used for command‑and‑control (C2) communications.

The malware transmits the device fingerprint data along with the victim's country, which is determined from the machine's time zone. It specifically checks if the time zones correspond to the U.K., Russia, Germany, France, China, Japan, the U.S., Brazil, India, Ukraine, Canada, Australia, Italy, Spain, and Poland. If that's not the case, it defaults to the U.S.

Advanced Persistence and Evasion Techniques

The second version of the campaign, spotted in late February 2026, eschews LNK files for Windows Control Panel modules, while keeping the infection sequence largely intact. Another notable change involves the backdoor itself, which has now been upgraded to allow recursive file enumeration, batch file uploads, and arbitrary file download.

"For security reasons, JavaScript does not allow the remote downloading of files," LAB52 said. "This is why the attackers use the Chrome DevTools Protocol (CDP), an internal protocol of Chromium‑based browsers that can only be used when the –remote-debugging-port parameter is enabled."

Development Stage and Detection Evasion

It's believed that the backdoor is still in the initial stages of development. An early variant of the malware detected in the wild on January 28, 2026, has been observed just communicating with the domain "gnome[.]com" instead of downloading the primary payload from Pastefy.

"One of the most notable aspects is the use of the browser to deploy a backdoor, which suggests that the attackers are exploring new ways to evade detection," the Spanish security vendor said. "The browser is advantageous for this type of activity because it is a common and generally non‑suspicious process, it offers extended capabilities accessible through debugging parameters that enable unsafe actions such as downloading remote files, and it provides legitimate access to sensitive resources such as the microphone, camera, or screen recording without triggering immediate alerts."

Technical Analysis and Mitigation

The DRILLAPP campaign demonstrates several concerning trends in modern cyber espionage:

• Living-off-the-land techniques: Using legitimate browser processes to avoid detection
• Multi-stage delivery: Complex infection chains with persistence mechanisms
• Geopolitical targeting: Specific focus on Ukrainian entities with time zone-based filtering
• Browser exploitation: Abuse of debugging features for malicious purposes

Organizations in Ukraine and other potentially targeted regions should implement the following security measures:

1. Monitor browser processes: Watch for unusual Edge browser executions with debugging parameters
2. Restrict startup folder modifications: Prevent unauthorized LNK file creation in startup locations
3. Network monitoring: Detect communications with Pastefy and other paste services
4. Endpoint detection: Deploy solutions capable of identifying canvas fingerprinting and unusual browser behavior
5. User awareness: Train personnel to recognize phishing lures related to Starlink and charity organizations

The campaign highlights the evolving sophistication of Russian-linked threat actors targeting Ukrainian interests, employing novel techniques that blend legitimate software with malicious functionality to achieve persistent espionage capabilities.

For organizations concerned about similar threats, consider implementing comprehensive endpoint security solutions that can detect browser-based backdoors and monitor for suspicious debugging parameter usage across all Chromium-based browsers.