SEQRITE Labs Uncovers “CAPI Backdoor” Campaign Targeting Russia’s Automobile and E-Commerce Sectors

SEQRITE Labs have uncovered a targeted spear-phishing campaign aimed at organisations in Russia’s automobile and e-commerce sectors, active since early October 2025. The operation deploys a previously undocumented .NET-based backdoor named CAPI, designed for credential theft, system reconnaissance and persistence.

The infection chain uses a malicious ZIP archive named Перерасчет заработной платы 01.10.2025, containing LNK and PDF files, with the LNK launching the DLL implant via rundll32.exe to establish an encrypted connection to the attackers’ C2 over TCP port 443. Once executed, the adobe.dll (also known as client6.dll) performs system surveillance, credential harvesting and data exfiltration, including browser data stored in ZIP archives.

CAPI includes anti-analysis and VM-detection features and dual persistence via Startup LNK and a scheduled task named AdobePDF. SEQRITE identified two infrastructures linked to CAPI operations, including a domain-generation algorithm domain and an ASN-based data-exfiltration host, with infrastructure movement suggesting ongoing campaign resilience.