New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs

Cybersecurity researchers have revealed a campaign distributing a new .NET malware called CAPI Backdoor, which targets the Russian automobile and e-commerce sectors via phishing emails that deliver a ZIP archive. According to Seqrite Labs, the ZIP artifact is paired with a decoy Russian-language document and a Windows LNK file that triggers the infection by invoking a legitimate Microsoft binary through rundll32.exe.

The backdoor, described as a .NET implant named adobe.dll, can check for administrator privileges, enumerate installed antivirus products, and open the decoy document to mask the malicious activity. It connects to a remote server at 91.223.75[.]96 to receive further commands and can steal data from Chrome, Edge and Firefox, take screenshots, gather system information, enumerate folders, and exfiltrate results.

Persistence is established via a scheduled task and by placing a LNK file in the Startup folder to launch the DLL from the Windows Roaming folder, while a domain named carprlce[.]ru is used to impersonate carprice[.]ru and suggest targeting of the Russian auto sector. The campaign’s infection chain is based on a ZIP artifact uploaded to VirusTotal on 3 October 2025.