DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage
Overview
A new espionage campaign has been detected, targeting Ukrainian entities and believed to be linked to Russian threat actors. This operation utilizes a backdoor known as DRILLAPP and exploits Microsoft Edge's debugging feature to remain stealthy. The campaign was first observed in February 2026 and shows similarities to a previous attack by a group known as Laundry Bear, which also focused on Ukrainian defense forces. This ongoing threat raises concerns about the security of sensitive information within Ukraine, especially as tensions in the region continue to escalate. Cybersecurity experts urge vigilance and prompt action to mitigate the risks posed by such sophisticated attacks.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Ukrainian defense forces, Microsoft Edge
- Action Required: Users are advised to utilize security best practices, such as keeping software updated and monitoring for unusual activity, although specific patches or updates were not mentioned.
- Timeline: Ongoing since February 2026
Original Article Summary
Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2 Grupo's LAB52 threat intelligence team. The campaign, observed in February 2026, has been assessed to share overlaps with a prior campaign mounted by Laundry Bear (aka UAC-0190 or Void Blizzard) aimed at Ukrainian defense forces with a malware
Impact
Ukrainian defense forces, Microsoft Edge
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since February 2026
Remediation
Users are advised to utilize security best practices, such as keeping software updated and monitoring for unusual activity, although specific patches or updates were not mentioned.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Microsoft, Malware.