Intrusions with the newly emergent CAPI Backdoor have been launched against automotive and e-commerce firms across Russia as part of a new phishing campaign, The Hacker News reports.
Threat actors have sent malicious emails with ZIP archives containing a fake Russian-language income tax legislation notice and an LNK file, with the latter triggering the execution of the .NET-based CAPI Backdoor, according to an analysis from Seqrite Labs.
Aside from ensuring operations with admin-level privileges and checking installed antivirus software in targeted systems, CAPI Backdoor also enables covert communications with a remote server, which provides commands that facilitate browser-stored data theft, system information gathering, folder content enumeration, and screenshot capturing.
Researchers also noted that the CAPI Backdoor established a scheduled task and LNK file within the Windows Startup folder to ensure persistence on infected systems.
"The malicious payload is a .NET DLL that functions as a stealer and establishes persistence for future malicious activities," researchers added.
