Loading story…
A Russia-linked cyber-espionage campaign targeted Ukrainian entities with a JavaScript-based backdoor called DRILLAPP, using lures themed around Starlink terminal verification and the Come Back Alive Foundation charity. Researchers linked the activity to Laundry Bear—also tracked as Void Blizzard and UAC-0190—and said the operation shared tradecraft with earlier campaigns against Ukrainian defense-related targets. The malware was observed in February 2026 and was designed for surveillance and remote access, including file upload and download, microphone recording, and webcam image capture.
The intrusion chain used malicious LNK files to create an HTA file in a temporary directory, fetch obfuscated scripts from Pastefy, and establish persistence by copying shortcuts into the Windows Startup folder. The payload then executed through Microsoft Edge in headless mode with permissive flags such as --no-sandbox, --disable-web-security, --allow-file-access-from-files, --use-fake-ui-for-media-stream, and --disable-user-media-security, enabling access to the local file system, camera, microphone, and potentially screen capture without normal user prompts. Researchers said the browser-based approach likely helps the attackers blend malicious activity with legitimate browser access to sensitive device features.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
On March 16, 2026, LAB52 publicly reported the February campaign, describing DRILLAPP as a JavaScript backdoor that abuses Microsoft Edge headless mode, browser debugging, and media-access features to capture files, audio, webcam images, and screen content.
A later February 2026 DRILLAPP variant changed delivery to Windows Control Panel module files while retaining the Edge-based execution chain. It also added recursive file enumeration, batch uploads, arbitrary downloads, and broader file-management functions.
The first observed campaign variant used LNK files to drop HTML or HTA content and retrieve obfuscated remote scripts hosted on Pastefy, establishing the browser-based backdoor on victim systems.
In February 2026, a cyber-espionage campaign targeted Ukrainian organizations using judicial, charity, and Starlink-themed lures to deliver the DRILLAPP backdoor. Researchers linked the activity with low confidence to the Russian-aligned Laundry Bear group based on overlaps with prior tradecraft used against Ukraine.
Researchers identified an earlier DRILLAPP sample dated January 28, 2026 that only communicated with gnome[.]com, indicating the malware was still in an early development stage before the broader campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026
CERT-UA reported that threat cluster **UAC-0247** targeted Ukrainian local governments, municipal clinics, emergency hospitals, and in some cases Defense Forces personnel with a phishing campaign delivering the newly identified **`AGINGFLY`** malware. The attacks used humanitarian-aid themed emails, compromised or fake websites, malicious archives, and **`LNK`** files that triggered **`mshta.exe`** to launch **`HTA`** payloads, scheduled tasks, and shellcode injection into legitimate processes before deploying **`RAVENSHELL`**, **`SILENTLOOP`**, and the C# backdoor **`AGINGFLY`**. Separate lures sent through Signal masqueraded as FPV drone operator software updates and used DLL side-loading to install the same malware. The intrusions were aimed at espionage and data theft, with **`AGINGFLY`** enabling remote command execution, file exfiltration, screenshots, keylogging, and arbitrary code execution, while dynamically compiling command handlers received from command-and-control servers. CERT-UA said the operators also stole credentials from Chromium-based browsers with **`CHROMELEVATOR`**, extracted WhatsApp data with **`ZAPIXDESK`**, and used tools including **`RUSTSCAN`**, **`LIGOLO-NG`**, and **`CHISEL`** for reconnaissance, tunneling, and lateral movement; at least one incident also involved **`XMRIG`** delivered through a modified WireGuard binary, indicating cryptomining alongside espionage. The agency urged defenders to restrict execution of **`LNK`**, **`HTA`**, and **`JS`** files and limit abuse of **`mshta.exe`**, **`powershell.exe`**, and **`wscript.exe`**.
Jun 29, 2026
A **large-scale phishing campaign** is using fake service and verification pages such as “ID Scanner,” “Telegram ID Freezing,” and “Health Fund AI” to trick victims into granting browser access to sensitive device capabilities. Once permissions are approved, malicious JavaScript captures **images, video, microphone audio, device details, contact information, and approximate geolocation**, then exfiltrates the data to attacker-controlled **Telegram bots** and related infrastructure. Researchers said the operation is hosted primarily on **`edgeone.app`** infrastructure and goes beyond traditional credential theft by collecting rich multimedia and contextual data that could support identity theft, follow-on social engineering, account compromise, or extortion. Analysis of the phishing framework found signs of **AI-assisted code generation**, including structured annotations and emoji-style formatting embedded in the code, indicating generative AI may have been used to speed development of the campaign. A separate report on the **DRILLAPP** malware targeting Ukrainian entities describes a different espionage operation involving Microsoft Edge headless mode, LNK and HTA execution, and Russia-linked targeting; despite some overlap in browser permission abuse and media capture, it is **not the same incident** and should be excluded from this story.
Jun 29, 2026