Russia

Back Securityaffairs.Co

Russia

Securityaffairs.Co •Pierluigi Paganini • March 16, 2026

Share: View original

Russia-linked threat actors target Ukrainian entities with DRILLAPP backdoor and use Edge debugging for stealth. A new DRILLAPP backdoor campaign targets Ukrainian organizations, abusing Microsoft Edge debugging to evade detection. Observed in February 2026, it shows links to Russian-aligned operations by Laundry Bear APT group (aka UAC-0190, Void Blizzard) using the PLUGGYAPE malware family […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russia-Linked DRILLAPP Backdoor Targets Ukrainian Entities via Microsoft Edge A new cyberespionage campaign has been identified, targeting Ukrainian organizations with a backdoor named DRILLAPP, attributed to Russian threat actors, specifically the Laundry Bear group. The campaign employs judicial- and charity-themed lures to deliver the malware, which operates through the Microsoft Edge browser. The initial variant, detected in early February 2026, utilized LNK files to execute an HTML Application that loaded a remote script. A second variant, observed later in February, switched to using CPL files, enhancing its capabilities to include batch file uploading and recursive file listing. The backdoor can access local files, the microphone, and the webcam, indicating a significant threat to privacy and data security. The campaign is ongoing, with researchers noting its early development stage and potential for further evolution. The attacks are part of a broader pattern of cyber operations targeting Ukrainian entities since 2024. 3 sources 76

Extracted Entities

APT Groups (3)

Laundry Bear APT Group Uac-0190 Void Blizzard

Attack Types (1)

Campaigns (1)

Drillapp Backdoor Campaign

Countries (1)

Malware (1)

Platforms (1)