CAPI Backdoor phishing ZIP campaign targeting Russian automobile and e-commerce sectors
Campaign
Summary
Hide ▲
Show ▼
A new CAPI Backdoor campaign is targeting Russian automobile and e-commerce sectors, using phishing emails with ZIP archives to deliver malware that can steal browser data and persist for later abuse. The initial lure uses a Russian-language decoy document and a matching LNK file to launch the implant through rundll32.exe. The backdoor connects to 91.223.75[.]96 for commands, screenshots, system information, and exfiltration. The campaign was tied to a ZIP artifact uploaded to VirusTotal on October 3, 2025.
Related Happenings
Tropic Trooper trojanized SumatraPDF remote-access campaign
Campaign
H score34
First: 24.04.2026 12:29
Last: 24.04.2026 12:29
Sources 1
About this happening:
Tropic Trooper is running an active campaign that uses a trojanized SumatraPDF lure to plant AdaptixC2 Beacon and later abuse VS Code tunnels for remote access...
Tropic Trooper trojanized SumatraPDF remote-access campaign
CampaignAbout this happening: Tropic Trooper is running an active campaign that uses a trojanized SumatraPDF lure to plant AdaptixC2 Beacon and later abuse VS Code tunnels for remote access...
SloppyLemming BurrowShell and Rust-based keylogger activity
Malware Activity
H score26
First: 03.03.2026 08:53
Last: 03.03.2026 08:53
Sources 1
About this happening:
SloppyLemming deployed BurrowShell and a Rust-based keylogger through two attack chains, expanding its malware toolkit for backdoor access, credential theft*...
SloppyLemming BurrowShell and Rust-based keylogger activity
Malware ActivityAbout this happening: SloppyLemming deployed BurrowShell and a Rust-based keylogger through two attack chains, expanding its malware toolkit for backdoor access, credential theft*...
Bloody Wolf / Stan Ghouls NetSupport RAT spear-phishing campaign
Campaign
H score31
First: 09.02.2026 12:58
Last: 09.02.2026 12:58
Sources 1
About this happening:
The Bloody Wolf / Stan Ghouls operation is actively running a spear-phishing campaign against Uzbekistan and Russia, and the activity matters because it is delivering...
Bloody Wolf / Stan Ghouls NetSupport RAT spear-phishing campaign
CampaignAbout this happening: The Bloody Wolf / Stan Ghouls operation is actively running a spear-phishing campaign against Uzbekistan and Russia, and the activity matters because it is delivering...
Multi-stage phishing campaign targeting users in Russia with Amnesia RAT and ransomware
Campaign
H score34
First: 24.01.2026 13:09
Last: 24.01.2026 13:09
Sources 1
About this happening:
A multi-stage phishing campaign is targeting users in Russia, delivering Amnesia RAT and ransomware that enable credential theft, remote control, and destr...
Multi-stage phishing campaign targeting users in Russia with Amnesia RAT and ransomware
CampaignAbout this happening: A multi-stage phishing campaign is targeting users in Russia, delivering Amnesia RAT and ransomware that enable credential theft, remote control, and destr...
Operation SkyCloak phishing backdoor campaign targeting Russia and Belarus defense sector
Campaign
H score29
First: 04.11.2025 12:49
Last: 04.11.2025 12:49
Sources 1
About this happening:
The Operation SkyCloak campaign is using phishing emails with weaponized attachments to seed a persistent backdoor on likely defense-sector systems in Russia and...
Operation SkyCloak phishing backdoor campaign targeting Russia and Belarus defense sector
CampaignAbout this happening: The Operation SkyCloak campaign is using phishing emails with weaponized attachments to seed a persistent backdoor on likely defense-sector systems in Russia and...
Timeline
-
18.10.2025 14:41 1 articles · 9mo ago
CAPI Backdoor ZIP artifact appears on VirusTotal
Detection Ioc UpdateA ZIP artifact associated with the CAPI Backdoor campaign is uploaded to VirusTotal and contains a decoy Russian-language document about income tax legislation plus a Windows shortcut named "Перерасчет заработной платы 01.10.2025" that launches the .NET implant "adobe.dll" through the legitimate Microsoft binary "rundll32.exe".
Show sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
18.10.2025 14:41 2 articles · 9mo ago
Seqrite Labs publicly describes the CAPI Backdoor phishing campaign
Initial DisclosureSeqrite Labs describes a new campaign likely targeting Russian automobile and e-commerce sectors with the previously undocumented .NET malware CAPI Backdoor. The phishing chain uses ZIP archives, a decoy Russian-language document, and a matching LNK file to launch the implant with rundll32.exe; the backdoor connects to 91.223.75[.]96, steals data from Google Chrome, Microsoft Edge, and Mozilla Firefox, takes screenshots, collects system information, enumerates folders, and establishes persistence with scheduled tasks and a Startup-folder LNK.
Show sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41