Russian‑Linked Espionage Group Uses Starlink & Charity Lures to Deploy DrillApp Spyware Against Ukrainian Entities
What Happened – A Russia‑affiliated hacker group identified as Laundry Bear (aka Void Blizzard) launched a cyber‑espionage campaign in February 2024. The actors distributed malicious documents masquerading as Starlink verification requests and as appeals from the Ukrainian charity “Come Back Alive,” installing a backdoor called DrillApp that can exfiltrate files, record audio, capture webcam images, and record the screen.
Why It Matters for TPRM –
- The campaign targets critical Ukrainian infrastructure (defense, transportation, education) and demonstrates how state‑aligned actors exploit legitimate services (Microsoft Edge, public text‑sharing sites) to bypass defenses.
- Social‑engineering lures tied to humanitarian aid and emerging satellite‑internet technology increase the likelihood of successful compromise in supply‑chain and partner environments.
- Early‑stage malware suggests rapid evolution of tactics that could be repurposed against allied organizations or third‑party vendors supporting Ukrainian operations.
Who Is Affected – Government and public‑sector entities in Ukraine (defense, education, transportation), as well as any third‑party vendors handling data or communications for these sectors.
Recommended Actions –
- Review any contracts or data flows with Ukrainian partners for exposure to this threat.
- Harden email and document handling policies; block execution of untrusted Office files and enforce strict macro controls.
- Deploy endpoint detection that monitors browser‑initiated access to microphones, cameras, and screen‑recording APIs.
- Conduct threat‑intel briefings for incident‑response teams on the DrillApp payload and its delivery mechanisms.
Technical Notes – The malicious payload is delivered via a crafted document that executes in Microsoft Edge, leveraging the browser’s legitimate access to device peripherals. DrillApp provides file system access, audio/video capture, and screen recording. No public CVE is associated; the technique relies on browser‑level permissions rather than a software vulnerability. Source: The Record