Operation DUPEHIKE Hits Russian HR: Bonus Lure Delivers DUPERUNNER and Adaptix C2 via Process Injection

Operation DUPEHIKE is a targeted espionage campaign uncovered by SEQRITE APT-Team that aims at corporate entities within the Russian Federation, focusing on human resources and payroll departments. According to SEQRITE APT-Team, the infection begins with a spear-phishing email bearing a malicious ZIP named Премия 2025[.]zip (Bonus 2025[.]zip), containing a LNK file Documento_1_0_размере_годовой_премии.pdf.lnk, which downloads and executes the DUPERUNNER implant via powershell.exe.

The DUPERUNNER stager then downloads a secondary payload disguised as a font file (fontawesome[.]woff) and performs process injection into explorer.exe, notepad.exe, and msedge.exe, with persistence achieved through classic remote-thread injection using VirtualAllocEx. The ultimate objective is to deploy the Adaptix C2 Beacon, a framework that, once injected, connects back to the attackers’ infrastructure and uses a custom, case-insensitive djb2-style hashing routine to resolve Windows APIs.

The campaign uses distinct infrastructure for payloads and C2: the download server at 46.149.71[.]230 and the C2 server at 195.2.70[.]190, with researchers noting a possible configuration change to port 443.