CAPI Backdoor Targets Russian Auto and E-Commerce Firms via .NET Malware
Summary
Hide ▲
Show ▼
A new campaign targeting the Russian automobile and e-commerce sectors uses a previously undocumented .NET malware, CAPI Backdoor. The attack chain involves phishing emails with ZIP archives containing a decoy document and a malicious Windows shortcut file. The malware, disguised as 'adobe.dll', uses legitimate Microsoft binaries to execute and establish persistence. It can steal data from browsers, take screenshots, and exfiltrate information. The campaign includes a domain impersonating a legitimate Russian automotive site.
Timeline
-
18.10.2025 14:41 1 articles · 23h ago
CAPI Backdoor Campaign Targets Russian Auto and E-Commerce Firms
A new campaign targeting the Russian automobile and e-commerce sectors uses a previously undocumented .NET malware, CAPI Backdoor. The attack chain involves phishing emails with ZIP archives containing a decoy document and a malicious Windows shortcut file. The malware, disguised as 'adobe.dll', uses legitimate Microsoft binaries to execute and establish persistence. It can steal data from browsers, take screenshots, and exfiltrate information. The campaign includes a domain impersonating a legitimate Russian automotive site.
Show sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
Information Snippets
-
The attack chain begins with phishing emails containing a ZIP archive.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
The ZIP archive includes a decoy Russian-language document and a malicious LNK file.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
The LNK file executes the .NET implant 'adobe.dll' using 'rundll32.exe'.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
The backdoor checks for administrator privileges, lists installed antivirus products, and opens the decoy document.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
The malware connects to a remote server at '91.223.75[.]96' for further commands.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
The backdoor can steal data from browsers, take screenshots, and exfiltrate information.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
The malware attempts to determine if it is running on a virtual machine or a legitimate host.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
Persistence is established via scheduled tasks and LNK files in the Windows Startup folder.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
-
The campaign includes a domain impersonating 'carprice[.]ru'.
First reported: 18.10.2025 14:411 source, 1 articleShow sources
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs — thehackernews.com — 18.10.2025 14:41
Similar Happenings
GPUGate Malware Campaign Targets IT Firms in Western Europe
A sophisticated malware campaign, codenamed GPUGate, targets IT and software development companies in Western Europe, with recent expansions to macOS users. The campaign leverages Google Ads, SEO poisoning, and fake GitHub commits to deliver malware, including the Atomic macOS Stealer (AMOS) and Odyssey. The attack began in December 2024 and uses a 128 MB Microsoft Software Installer (MSI) to evade detection. The malware employs GPU-gated decryption and various techniques to avoid analysis and detection. The end goal is information theft and delivery of secondary payloads. The threat actors have native Russian language proficiency and use a cross-platform approach. The campaign has expanded to target macOS users through fake Homebrew, LogMeIn, and TradingView platforms. These platforms impersonate popular tools and use SEO poisoning to distribute the Atomic Stealer malware and Odyssey. The threat actors use multiple GitHub usernames to evade takedowns and deploy malware via Terminal commands. Similar tactics have been observed in previous campaigns using malicious Google Ads and public GitHub repositories. The AMOS malware now includes a backdoor component for persistent, stealthy access to compromised systems. The campaign impersonates over 100 software solutions, including 1Password, Dropbox, Confluence, Robinhood, Fidelity, Notion, Gemini, Audacity, Adobe After Effects, Thunderbird, and SentinelOne. The fake GitHub pages were created on September 16, 2025, and were immediately submitted for takedown. The campaign has been active since at least April 2023, with previous similar campaigns observed in July 2025.