Full Report
LAB52, the intelligence team at S2 Group, has identified a new campaign targeting Ukrainian entities, attributed to actors linked to Russia. The campaign, observed during February 2026, employs various judicial and charity themed lures to deploy a JavaScript‑based backdoor that runs through the Edge browser and has been named DRILLAPP by LAB52. This artifact enables […]
Analysis Summary
# Threat Actor: Laundry Bear (Low Confidence)
## Attribution & Identity
* **Actor Identification:** Attributed to actors linked to Russia.
* **Aliases:** Laundry Bear (low confidence attribution by LAB52).
* **Known Associations:** Linked to activity previously reported by CERT-UA in January 2026.
## Activity Summary
In February 2026, a campaign targeting Ukrainian entities was identified deploying a JavaScript-based backdoor named **DRILLAPP**. The campaign utilized two primary variants:
* **Variant 1 (Early Feb 2026):** Used LNK files and judicial/charity lures to execute code via the Microsoft Edge browser in headless mode.
* **Variant 2 (Late Feb 2026):** Transitioned to using CPL files (Windows Control Panel modules) while maintaining similar browser-based backdoor functionality but adding enhanced file manipulation capabilities.
## Tactics, Techniques & Procedures
* **Lure Themes:** Judicial documents, weapons seizure reports, and charity-themed lures (Come Back Alive foundation, Starlink installation).
* **Persistence:** Copying LNK files to the Windows Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup`).
* **Execution:** Leveraging Microsoft Edge in headless mode with specific flags (`--no-sandbox`, `--disable-web-security`, `--use-fake-ui-for-media-stream`) to bypass security prompts and access hardware.
* **Obfuscation:** Use of the open-source `javascript-obfuscator` tool.
* **Evasion:** Deployment via public text-sharing services to host operational artifacts.
* **Fingerprinting:** Canvas Fingerprinting combined with system data (screen size, language) to generate a unique `stream_client_id`.
* **Exfiltration/Command:** Use of WebSockets for C2 communication and Chrome DevTools Protocol for advanced file system interaction.
## Targeting
* **Sectors:** Government (State Audit Service), Military support (Come Back Alive foundation), and general Ukrainian entities.
* **Geography:** Ukraine.
* **Victims:** Southern Office of the State Audit Service of Ukraine (Mykolaiv region); National Guard of Ukraine (impersonated in lures).
## Tools & Infrastructure
* **Malware Families:** **DRILLAPP** (JavaScript backdoor).
* **Artifact Types:** LNK files, CPL files, HTML, JavaScript.
* **Infrastructure:**
* **Text Sharing:** hxxps://pastefy[.]app
* **URL Shorteners:** hxxps://short-link[.]net
* **Image Hosting:** hxxps://iili[.]io
* **C2 IPs:** 80.89.224[.]13, 188.137.228[.]162
* **Debugging/Local C2:** localhost:8000
## Implications
The use of browser-based backdoors (DRILLAPP) represents a sophisticated shift to evade traditional endpoint detection. By running in "headless" mode with security flags disabled, the actor can turn a standard web browser into a powerful surveillance tool capable of silent audio/video recording and file exfiltration. The rapid evolution from LNK to CPL files indicates an active, adaptive development cycle.
## Mitigations
* **Browser Hardening:** Restrict the execution of browsers with command-line arguments like `--no-sandbox` or `--remote-debugging-port` via policy (GPO).
* **File Execution Policies:** Block or monitor the execution of `.cpl` and `.lnk` files from untrusted sources or temporary directories.
* **Network Monitoring:** Monitor for unusual WebSocket connections to unknown IP addresses and traffic to public paste sites (e.g., pastefy.app) from automated processes.
* **Endpoint Security:** Implement rules to detect the creation of files in the Windows Startup folder by non-standard processes.