Loading malware…
CAPI Backdoor is a previously undocumented .NET backdoor/stealer identified by Seqrite Labs in a phishing campaign tracked as Operation MotorBeacon. The campaign targeted organizations in Russia’s automobile and e-commerce sectors. Initial access was achieved via phishing emails delivering a ZIP archive themed as a payroll recalculation notice ("Перерасчет заработной платы 01.10.2025") containing a malicious LNK file and a decoy PDF ("Notification for the Tax Office No. P4353.pdf"). When executed, the LNK launched a .NET DLL implant, including samples referred to as adobe.dll and client6.dll, via rundll32.exe and opened the decoy document to distract the victim.
The malware checks for administrator privileges, enumerates installed antivirus products via WMI, and performs multiple anti-analysis and anti-VM checks. It connects to command-and-control infrastructure at 91.223.75[.]96, including over TCP port 443, to receive commands and exfiltrate data. Reported capabilities include stealing browser data from Chrome, Edge, and Firefox; capturing screenshots; collecting system information; enumerating folders; retrieving current user information; and sending collected data to attacker-controlled infrastructure. Browser theft functionality was described as collecting profile data and packaging it into archives such as edprofile.zip, chprofile_safe.zip, and ffprofile_safe.zip before transmission.
For persistence, CAPI Backdoor copies itself into the user’s Roaming AppData Microsoft folder and either creates a Startup-folder shortcut (Microsoft.lnk) that launches the DLL via rundll32.exe or creates a scheduled task named AdobePDF to execute the backdoor periodically. Seqrite reported the campaign had been active since at least October 3, 2025. Infrastructure associated with the activity included the typosquatted domain carprlce[.]ru, made to resemble the legitimate carprice[.]ru, and hosting linked to ASN 197695 and ASN 39087. Reported IOCs include MD5 c6a6fcec59e1eaf1ea3f4d046ee72ffe (ZIP), 957b34952d92510e95df02e3600b8b21 (LNK), c0adfd84dfae8880ff6fd30748150d32 (adobe.dll), the domain carprlce[.]ru, and IP 91.223.75[.]96.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
This function checks for all the installed Antivirus software ... using the query SELECT * FROM AntiVirusProduct using WMI ... CheckHypervisorPresent – This function uses query SELECT HypervisorPresent FROM Win32_ComputerSystem
makes use of two methods to establish persistence, including setting up a scheduled task
The malware runs multiple VM/analysis checks and establishes persistence by creating a scheduled task and placing a LNK in the Windows Startup folder to auto-launch the backdoor DLL from the Roaming directory.
The LNK file, which has the same name as the ZIP archive ... is responsible for the execution of the .NET implant ("adobe.dll") using a legitimate Microsoft binary named "rundll32.exe" | and creating a LNK file in the Windows Startup folder to automatically launch the backdoor DLL copied to the Windows Roaming folder
makes use of two methods to establish persistence, including setting up a scheduled task
The malware runs multiple VM/analysis checks and establishes persistence by creating a scheduled task and placing a LNK in the Windows Startup folder to auto-launch the backdoor DLL from the Roaming directory.
The LNK file, which has the same name as the ZIP archive ... is responsible for the execution of the .NET implant ("adobe.dll") using a legitimate Microsoft binary named "rundll32.exe" | and creating a LNK file in the Windows Startup folder to automatically launch the backdoor DLL copied to the Windows Roaming folder
Present with the archive is a decoy Russian-language document that purports to be a notification related to income tax legislation
the malicious LNK named Перерасчет заработной платы 01.10.2025.lnk ... is responsible for execution of the malicious .NET implant using the LOLBIN known as rundll32.exe.
The commands allow CAPI Backdoor to steal data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox
ExecuteCommand – This function implements the instructions ... stealing the data from browsers like Chrome, Edge and Firefox ... dmp1, dmp2 and dmp3 – These three functions are responsible for stealing the Browser data of the current user in the machine.
comes with functions to check if it's running with administrator-level privileges
The commands allow CAPI Backdoor to ... collect system information
The function dmp1 makes directory named edprofile_yyyyMMddHHmmss and try to iterate through all the files and folders available in the Local State folder ... Similarly function dmp2 ... stores all the data such as Bookmarks, History, Favicons, Top Sites, Preferences, Extensions.
CAPI Backdoor supports multiple functionalities such as stealing browser data (Chrome, Edge, Firefox), taking screenshots, gathering system info, listing folders and exfiltrating results.
The LNK file runs a .NET backdoor (“adobe.dll”) via rundll32.exe, checks admin rights and AV tools, then opens the decoy document before connecting to 91.223.75[.]96 to receive commands.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously unknown .NET backdoor used in phishing attacks against Russian automobile and e-commerce organizations. It is delivered via a malicious LNK inside a ZIP archive, executed through rundll32.exe as a .NET DLL, connects to C2 infrastructure, steals browser data from Chrome, Edge, and Firefox, takes screenshots, gathers system information, lists folders, exfiltrates data, performs VM/analysis checks, and establishes persistence via a scheduled task and a Startup-folder LNK.
A previously undocumented .NET backdoor/stealer delivered via phishing ZIP archives containing an LNK file. It executes through rundll32.exe, checks for admin privileges and antivirus products, performs anti-VM checks, establishes persistence via scheduled task and Startup-folder LNK, connects to a remote server for commands, steals browser data, takes screenshots, collects system information, enumerates folders, and exfiltrates results.
A .NET DLL implant used in a spear-phishing campaign targeting the Russian automobile and e-commerce sectors. It executes via rundll32.exe, connects to a C2 server over TCP/443, receives commands, steals browser data from Chrome, Edge, and Firefox, captures screenshots, gathers host and AV information, performs VM checks, and establishes persistence via Startup LNK and a scheduled task.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.