DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear

LAB52 identified a new cyber espionage campaign targeting Ukrainian entities using a JavaScript-based backdoor named DRILLAPP, delivered via malicious LNK and CPL files. The malware leverages Microsoft Edge in headless mode with permissive command-line flags to enable remote surveillance capabilities including microphone, webcam, and screen capture. The campaign uses lures themed around judicial and charity topics, with infrastructure hosted on public text-sharing services like pastefy.app. Activity shows possible links to the Russian-aligned threat actor Laundry Bear, based on overlapping tactics such as lure themes and hosting patterns.

AI-extracted · verify before operational use