{"id":3152,"date":"2026-03-13T10:20:06","date_gmt":"2026-03-13T09:20:06","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=3152"},"modified":"2026-03-13T13:55:12","modified_gmt":"2026-03-13T12:55:12","slug":"drillapp-new-backdoor-targeting-ukrainian-entities-with-possible-links-to-laundry-bear","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/drillapp-new-backdoor-targeting-ukrainian-entities-with-possible-links-to-laundry-bear\/","title":{"rendered":"DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear"},"content":{"rendered":"\n

LAB52, the intelligence team at S2 Group, has identified a new campaign targeting Ukrainian entities, attributed to actors linked to Russia. The campaign, observed during February 2026, employs various judicial and charity themed lures to deploy a JavaScript\u2011based backdoor that runs through the Edge browser and has been named DRILLAPP by LAB52. This artifact enables the attacker to carry out several actions on the target, such as uploading and downloading files, using the microphone, or capturing images through the webcam by leveraging the browser\u2019s capabilities.<\/p>\n\n\n\n

Certain tactics shared with a Laundry Bear campaign reported by CERT-UA in January<\/a> have been observed, resulting in the activity being attributed to this group with low confidence. These include the use of charity\u2011themed lures or the hosting of operational artifacts on public text\u2011sharing services.<\/p>\n\n\n\n

Two variants of the campaign have been identified, differentiated mainly by their timeline.<\/p>\n\n\n\n

First variant<\/h1>\n\n\n\n

The first identified variant dates back to early February. It uses LNK files that create an HTML file in the temporary folder, which then loads a remote script hosted on pastefy.app. For persistence, the executable copies all files with the .lnk extension to the \u201c%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\u201d folder.<\/p>\n\n\n

\n
\"\"
Command executed by the LNK file<\/figcaption><\/figure><\/div>\n\n\n

Next, a URL containing the bait will be displayed. In this first variant, the bait can cover different topics, such as an image related to the installation of Starlink. Bait simulating requests from the Come Back Alive foundation, a Ukrainian charity founded in 2014 and dedicated to supporting the Ukrainian Armed Forces, has also been observed.<\/p>\n\n\n

\n
\"\"
Lure displayed with information about the Starlink installation<\/figcaption><\/figure><\/div>\n\n\n

Finally, the execution of an HTML file is observed through the Microsoft Edge browser, which loads a remote script hosted on pastefy.app. This script is obfuscated using the open-source tool javascript-obfuscator.<\/p>\n\n\n

\n
\"\"
Code obfuscated using javascript-obfuscator<\/figcaption><\/figure><\/div>\n\n\n

The browser is executed in headless mode, enabling a series of parameters such as –no-sandbox, –disable-web-security, –allow-file-access-from-files, –use-fake-ui-for-media-stream, –auto-select-screen-capture-source=true, and –disable-user-media-security. These settings allow local file access and automatically grant permissions for the camera, microphone, and screen capture without user interaction.<\/p>\n\n\n\n

Using deobfuscation techniques, it has been possible to partially recover the code of the artifact, which functions as a lightweight backdoor allowing the attacker to access the file system and record audio from the microphone, video from the camera, and the device\u2019s screen, all through the browser.<\/p>\n\n\n

\n
\"\"
Capabilities of the first variant<\/figcaption><\/figure><\/div>\n\n\n

When executed for the first time, the malware generates a device fingerprint using Canvas Fingerprinting combined with other data such as screen size and system language. These values are hashed to create the fingerprint. This fingerprint is then stored in the \u201cstream_client_id\u201d field within the browser\u2019s persistent storage.<\/p>\n\n\n

\n
\"\"
Device fingerprint generation<\/figcaption><\/figure><\/div>\n\n\n

This device fingerprint is sent together with the victim\u2019s country, which is determined based on the device\u2019s time zone. Only the time zones corresponding to the United Kingdom, Russia, Germany, France, China, Japan, the United States, Brazil, India, Ukraine, Canada, Australia, Italy, Spain, and Poland are implemented. In any other case, the system defaults to returning the United States.<\/p>\n\n\n

\n
\"\"
Time zones detected by the artifact<\/figcaption><\/figure><\/div>\n\n\n

The artifact communicates with the command\u2011and\u2011control server through a WebSocket obtained from a URL hosted on pastefy.app, using localhost:8000 as the default value if the URL is unavailable. This default value is expected to be replaced with a real IP address in later versions and is believed to be a debugging trace.<\/p>\n\n\n

\n
\"\"
Retrieval of the WebSocket via pastefy.app<\/figcaption><\/figure><\/div>\n\n\n

Second variant<\/h1>\n\n\n\n

The second variant, detected in late February 2026, abandons the use of LNK files and adopts CPL files\u2014Windows Control Panel modules that internally function as executable DLL libraries. Although a change in the deployment method has been observed, this new variant exhibits behavior similar to the first one. The lures used in this case include an image of a weapons seizure report and a report from the Southern Office of the State Audit Service of Ukraine in the Mykolaiv region, which is displayed from the official website of the National Guard of Ukraine.<\/p>\n\n\n

\n
\"\"
Lure displayed from the Southern Office of the State Audit Service of Ukraine<\/figcaption><\/figure><\/div>\n\n\n

The backdoor downloaded by the second variant of the campaign implements three new capabilities that allow recursive file listing, batch file uploading, and file downloading from the internet.<\/p>\n\n\n

\n
\"\"
Capabilities of the second variant<\/figcaption><\/figure><\/div>\n\n\n

For security reasons, JavaScript does not allow the remote downloading of files. This is why the attackers use the Chrome DevTools Protocol (CDP), an internal protocol of Chromium\u2011based browsers that can only be used when the –remote-debugging-port parameter is enabled.<\/p>\n\n\n

\n
\"\"
Use of CDP through debugging port 9222<\/figcaption><\/figure><\/div>\n\n\n

This is initially used to modify the path where the file will be saved.<\/p>\n\n\n

\n
\"\"
Modification of the download folder via CDP<\/figcaption><\/figure><\/div>\n\n\n

A small script is then injected into the browser, which simulates a user click and downloads the file from the remote server.<\/p>\n\n\n

\n
\"\"
Code injection simulating the user click<\/figcaption><\/figure><\/div>\n\n\n

Early activity<\/h1>\n\n\n\n

Additionally, a sample dated January 28 and uploaded from Russia has been identified, in which a similar infection chain and set of commands are used. However, in this case, instead of downloading the backdoor, the artifact establishes communication with the website gnome.com, which does not contain any malicious code.<\/p>\n\n\n

\n
\"\"
Command observed in the PoC<\/figcaption><\/figure><\/div>\n\n\n

This sample may represent early activity of the campaign and is attributed to the same actor with a high degree of confidence, given its similarity to the samples from the first variant.<\/p>\n\n\n\n

Conclusion<\/h1>\n\n\n\n

The analysis conducted indicates that DRILLAPP is a recent artifact that is still in an early stage of development. One of the most notable aspects is the use of the browser to deploy a backdoor, which suggests that the attackers are exploring new ways to evade detection. The browser is advantageous for this type of activity because it is a common and generally non\u2011suspicious process, it offers extended capabilities accessible through debugging parameters that enable unsafe actions such as downloading remote files, and it provides legitimate access to sensitive resources such as the microphone, camera, or screen recording without triggering immediate alerts.<\/p>\n\n\n\n

Intelligence Availability Notice<\/h1>\n\n\n\n

This article presents selected insights derived from our broader threat intelligence operations and coverage. Additional details related to this campaign, as well as other investigations and ongoing intelligence activities, are enriched and available through our\u00a0private intelligence feed.<\/a><\/strong><\/p>\n\n\n\n

Indicators of Compromise (IOC)<\/h1>\n\n\n\n

First variant<\/strong><\/h2>\n\n\n\n

5b978cdc46afa28d83e532cd19622d9097bebedf87efc4c87bd35d8ffad9e672\u00a0<\/p>\n\n\n\n

6178b1af51057c0bac75a842afff500a8fa3ed957d79a712a6ef089bec7e7a8b\u00a0<\/p>\n\n\n\n

ac60eefc2607216f8126c0b22b6243f3862ef2bb265c585deee0d00a20a436b3\u00a0<\/p>\n\n\n\n

e20831cecd763d0dc91fb39f3bd61d17002608c5a40a6cf0bd16111f4e50d341\u00a0<\/p>\n\n\n\n

ee90b01b16099e0bb23d4653607a3a559590fc8d0c43120b8456fb1860d2e630\u00a0<\/p>\n\n\n\n

32973ef02e10a585a4a0196b013265e29fc57d8e1c50752f7b39e43b9f388715<\/p>\n\n\n\n

\n\n\n\n

Second variant<\/strong><\/h2>\n\n\n\n

107b2badfc93fcdd3ffda7d3999477ced3f39f43f458dd0f6a424c9ab52681c3\u00a0<\/p>\n\n\n\n

a545908c931ec47884b5ccfb1f112435f5d0cdac140e664673672c9df9016672\u00a0<\/p>\n\n\n\n

352f34ea5cc40e2b3ec056ae60fa19a368dbd42503ef225cb1ca57956eb05e81\u00a0<\/p>\n\n\n\n

c6905bae088982a2b234451b45db742098f2e2ab4fd6ca62c8f4e801160552aa\u00a0<\/p>\n\n\n\n

993d55f60414bf2092f421c3d0ac6af1897a21cc4ea260ae8e610a402bf4c81c\u00a0<\/p>\n\n\n\n

ccb7d999ee4d979e175b8c87e09ccda0cbc93b6140471283e3a1f1f9da33759d\u00a0<\/p>\n\n\n\n

51e86408904c0ca3778361cde746783a0f2b9fd2a6782aa7e062aa597151876e\u00a0<\/p>\n\n\n\n

fb16933b09a4fcca5beff93da05566e924017fb534a2f45caf57b57a633f43a6\u00a0<\/p>\n\n\n\n

2b5d8f8db5fd38ae1c34807dcba35b057cffa61eb14ba3b558f82eb630480c3f\u00a0<\/p>\n\n\n\n

eb9c1649e01db6a9a94d5d50373e54865d672b14ad6f221c98047c562d3cc0f3\u00a0<\/p>\n\n\n\n

8c6ea44ce7f4ed4e4e7e19e11b3b345d58785c93b33aa795ddd1b0d753236b05\u00a0<\/p>\n\n\n\n

66a7828bc8c6c783b2ffa3c906d53f6dae1bbddc019283cc369d7d73247c5181\u00a0<\/p>\n\n\n\n

886df55794cbca146de96dcc626471b3c097a5c20ba488033b24f4347aa20a14\u00a0<\/p>\n\n\n\n

9367f4b4d2775ff47279d143dd9a0ef544ddff81946aab33da9350a49f14e1e1\u00a0<\/p>\n\n\n\n

b891fa118db5190f07b18be46eb9bc10677f9afab1406a7d52ce587522ab3d28\u00a0<\/p>\n\n\n\n

bad7c6f6ca25363a02eaceb3ed1e378218dc4a246a63d723cfcc5feee3af5056\u00a0<\/p>\n\n\n\n

21fefc3913d3d2dfde7f0dff54800ca7512eb5df9513b1a457a2af25fdd51b26\u00a0<\/p>\n\n\n\n

801c47550799831bfb1ac6c5c3fd698be95da19fc85bd65f5d8639f26244d2a9<\/p>\n\n\n\n

\n\n\n\n

DRILLAPP<\/strong><\/h2>\n\n\n\n

6fea579685d2433cedb1c32ef704575dcbc1d0a623769e824023ffccd0dedaae\u00a0<\/p>\n\n\n\n

76eb713e38f145ee68b89f2febd8f9a28bbb2b464da61cb029d84433a0b2c746\u00a0<\/p>\n\n\n\n

\n\n\n\n

Network indicators<\/strong><\/h2>\n\n\n\n

80.89.224[.]13<\/p>\n\n\n\n

188.137.228[.]162\u00a0\u00a0<\/p>\n\n\n\n

hxxps:\/\/pastefy[.]app\/f69UjsFE\/raw<\/p>\n\n\n\n

hxxps:\/\/pastefy[.]app\/nkjTcFw3\/raw<\/p>\n\n\n\n

hxxps:\/\/short-link[.]net\/ZVMEq\u00a0<\/p>\n\n\n\n

hxxps:\/\/pastefy[.]app\/f69UjsFE\/raw\u00a0<\/p>\n\n\n\n

hxxps:\/\/short-link[.]net\/KCVTt\u00a0<\/p>\n\n\n\n

hxxps:\/\/iili[.]io\/fphPR3b.jpg\u00a0<\/p>\n\n\n\n

hxxps:\/\/short-link[.]net\/HdviE\u00a0<\/p>\n\n\n\n

hxxps:\/\/iili[.]io\/q995YYu.jpg\u00a0<\/p>\n\n\n\n

hxxps:\/\/pastefy[.]app\/nkjTcFw3\/raw\u00a0<\/p>\n\n\n\n

hxxps:\/\/iili[.]io\/q995zhl.jpg\u00a0<\/p>\n\n\n\n

hxxps:\/\/iili[.]io\/q995IQ2.jpg\u00a0<\/p>\n\n\n\n

hxxps:\/\/iili[.]io\/qKOFGe4.jpg\u00a0<\/p>\n\n\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

LAB52, the intelligence team at S2 Group, has identified a new campaign targeting Ukrainian entities, attributed to actors linked to Russia. The campaign, observed during February 2026, employs various judicial and charity themed lures to deploy a JavaScript\u2011based backdoor that runs through the Edge browser and has been named DRILLAPP by LAB52. This artifact enables […]<\/p>\n","protected":false},"author":28,"featured_media":3183,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":"[]"},"categories":[1],"tags":[],"class_list":{"0":"post-3152","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-uncategorised","8":"entry"},"featured_image_src":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2026\/03\/drillapp.png","featured_image_src_square":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2026\/03\/drillapp.png","author_info":{"display_name":"3722304989","author_link":"https:\/\/lab52.io\/blog\/author\/3722304989\/"},"_links":{"self":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/3152"}],"collection":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/comments?post=3152"}],"version-history":[{"count":12,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/3152\/revisions"}],"predecessor-version":[{"id":3186,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/3152\/revisions\/3186"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media\/3183"}],"wp:attachment":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media?parent=3152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/categories?post=3152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/tags?post=3152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}