DRILLAPP Backdoor Targets Ukraine Using Microsoft Edge Debugging for Stealth Espionage

Ukrainian organizations have become the target of a sophisticated cyber espionage campaign believed to be linked to Russian threat actors, according to findings from S2 Grupo.

The campaign, observed in February 2026, introduces a JavaScript-based backdoor dubbed DRILLAPP, designed to operate through the Microsoft Edge browser to evade traditional security detection.

Links to Previous Campaigns

Researchers noted similarities between this activity and earlier attacks attributed to the threat group Laundry Bear (UAC-0190 / Void Blizzard), which previously targeted Ukrainian defense sectors using malware such as PLUGGYAPE.

These overlaps suggest a continued focus on Ukraine by advanced threat actors leveraging evolving tactics.

Attack Chain and Initial Access

The attack begins with social engineering lures themed around legal matters and charitable initiatives.

In the first observed variant, attackers distribute malicious Windows shortcut (LNK) files that trigger the creation of an HTML Application (HTA) file within the system’s temporary directory.

This HTA file then retrieves a remote script hosted on Pastefy, a legitimate paste-sharing service commonly abused for malicious purposes.

To maintain persistence, the malicious LNK files are copied into the Windows Startup folder, ensuring execution after system reboot.

Use of Browser for Malware Execution

A defining feature of the DRILLAPP campaign is its use of Microsoft Edge in headless mode, allowing it to run without a visible interface.

The browser is launched with multiple unsafe parameters, including:

• --no-sandbox
• --disable-web-security
• --allow-file-access-from-files
• --use-fake-ui-for-media-stream
• --auto-select-screen-capture-source
• --disable-user-media-security

These flags grant the malware access to:

• Local file systems
• Microphone and audio input
• Webcam and video capture
• Screen recording capabilities

All of this occurs without requiring user interaction, making detection significantly more difficult.

Backdoor Capabilities

Once active, DRILLAPP functions as a lightweight espionage tool capable of:

• Uploading and downloading files
• Capturing audio from the microphone
• Recording video via the webcam
• Taking screenshots of the device

The malware also generates a unique device fingerprint using canvas fingerprinting techniques, enabling attackers to track infected systems.

Command-and-Control Communication

Instead of directly contacting attacker-controlled infrastructure, DRILLAPP uses Pastefy as a dead drop resolver to retrieve a WebSocket-based command-and-control (C2) endpoint.

It transmits system information, including:

• Device fingerprint
• Country (derived from system time zone)

The malware explicitly checks for multiple geographic regions, including Ukraine, the U.S., Germany, India, and others, defaulting to the U.S. if no match is found.

Evolution of the Campaign

A second variant of the campaign, identified later in February 2026, replaces LNK files with Windows Control Panel modules while maintaining a similar infection flow.

This updated version enhances functionality with:

• Recursive file enumeration
• Batch file uploads
• Arbitrary file downloads

Abuse of Edge Debugging Protocol

A critical aspect of the attack is the abuse of the Chrome DevTools Protocol (CDP), an internal debugging interface used by Chromium-based browsers.

By enabling the --remote-debugging-port parameter, attackers bypass standard browser restrictions and execute actions such as downloading files remotely—capabilities typically restricted in JavaScript environments.

Early-Stage Development Indicators

Researchers observed that an earlier version of the malware, detected in January 2026, only communicated with a domain (“gnome[.]com”) without deploying the full payload.

This suggests that DRILLAPP is still evolving, with threat actors actively refining its capabilities.

Strategic Implications

The use of a web browser as a malware execution platform represents a significant shift in attack methodology.

Browsers like Microsoft Edge are trusted, widely used, and capable of accessing sensitive system resources—making them ideal tools for stealth operations.

By leveraging legitimate browser functionality, attackers can:

• Blend malicious activity with normal processes
• Avoid raising immediate security alerts
• Maintain persistent access to compromised systems

Mitigation and Recommendations

To defend against such threats, organizations should:

• Restrict execution of unknown scripts and HTA files
• Monitor browser processes for unusual parameters
• Disable unnecessary debugging features
• Implement endpoint detection and response (EDR) solutions
• Educate users about social engineering tactics

Final Insight

The DRILLAPP campaign underscores a growing trend in cyber espionage—weaponizing legitimate applications to bypass security controls.

As attackers continue to innovate, organizations must adopt a proactive, behavior-based security approach to detect threats that no longer rely on traditional malware signatures.