Loading threat actor…
CapFIX is a financially motivated cybercrime threat cluster associated with malicious email campaigns delivering the CapDoor backdoor against organizations in Russia. The group has targeted retailers, collection agencies, microfinance institutions, insurance companies, and other financial organizations using socially engineered lures themed around urgent security guidance, terrorism-related instructions, and mandatory reporting requirements. The activity is characterized by spoofed sender identities, PDF attachments that direct victims to download a fake CryptoPro installer, delivery of password-protected archives and malicious MSI packages, and execution chains that culminate in DLL side-loading through legitimate signed software. CapFIX operations have been linked to deployment of modified x64 variants of CapDoor. Observed CapDoor functionality includes remote execution of PowerShell commands, downloading and launching additional executable payloads, execution of DLL payloads through rundll32, and registration or execution of DLL COM objects through regsvr32. The intrusion chain also uses execution guards such as marker files to avoid repeated runs. Infrastructure and lure reuse across multiple waves indicate an organized campaign with recurring themes and delivery mechanisms. The actor has also used compromised legitimate websites and attacker-controlled infrastructure disguised as trusted software-update or enterprise-service resources to support malware delivery and command-and-control. Reported aliases are limited to CapFIX, and the malware family most closely associated with the cluster is CapDoor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
22 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly identified phishing-driven intrusion cluster distributing the CapDoor backdoor via spoofed emails themed as mine-threat and anti-information-attack instructions, targeting Russian retail, collection agencies, microfinance institutions, and insurance companies.
Financially motivated threat group linked to malicious PDF lure documents that downloaded archives from compromised legitimate websites and used the CapDoor malware with C2 infrastructure masquerading as Windows update domains.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.