DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage

This article covers DRILLAPP, a JavaScript-based backdoor targeting Ukrainian entities, attributed to threat actors linked to Russia's Laundry Bear group.

• •The malware is deployed via LNK files or Windows Control Panel modules using judicial and charity-themed lures (Starlink, Come Back Alive Foundation).
• •DRILLAPP runs through Microsoft Edge in headless mode with parameters like --no-sandbox and --disable-web-security to bypass browser security restrictions.
• •It abuses the Chrome DevTools Protocol (CDP) with --remote-debugging-port to enable file downloads that JavaScript normally blocks.
• •Capabilities include file upload/download, microphone capture, webcam imaging, screen capture, and device fingerprinting via canvas fingerprinting.
• •