CAPI Backdoor targets Russia’s auto and e-commerce sectors

According to Seqrite Labs, a new campaign named Operation MotorBeacon targets Russia’s auto and e-commerce sectors with a previously unknown .NET malware dubbed CAPI Backdoor. The attack chain begins with spearphishing emails that carry a ZIP archive titled “Перерасчет заработной платы 01.10.2025” containing a malicious LNK that launches a .NET implant via rundll32.exe and connects to a C2 server.

The decoy PDF within the archive pretends to be a Tax Office notice effective Oct 1 2025, outlining a PIT hike and urging employees to consult HR before exposing the lure to victims.

The LNK file runs a .NET backdoor (“adobe.dll”), checks admin rights and AV tools, then opens the decoy document before contacting 91.223.75[.]96 to receive commands, and the malware can steal browser data, take screenshots, gather system information, and exfiltrate results while attempting persistence via a scheduled task and a startup-folder LNK.

Researchers identified two network artifacts tied to the CAPI Backdoor, including a DGA-generated domain, with early infrastructure under ASN 197695 and data exfiltration via ASN 39087 (P.a.k.t LLC); the campaign has used a fake domain carprlce[.]ru that resembled carprice[.]ru to target the automobile sector.