CAPI Backdoor: .NET Stealer Targeting Russian Auto-Commerce
Source AlienVault OTX General
Description
A spear-phishing campaign targeting the Russian Automobile-Commerce industry using a malicious.NET implant has been uncovered by Seqrite Labs Research Team and is now being investigated by the FBI.
Impact
For European organizations, the direct impact may be limited given the campaign's focus on Russian automobile-commerce. However, European companies with subsidiaries, partners, or supply chain links to Russian automotive commerce could be at risk of collateral compromise. The malware's data-stealing capabilities threaten confidentiality by exfiltrating sensitive business and credential information. Integrity and availability impacts are less pronounced but possible if the backdoor is used for further lateral movement or disruption. The use of phishing as an infection vector means that organizations with less mature email security and user awareness programs are more vulnerable. Additionally, the malware's use of LOLBins complicates detection, increasing dwell time and potential damage. The geopolitical tensions involving Russia may also increase the likelihood of targeting European companies with indirect ties to the region. Overall, the threat could lead to intellectual property theft, financial loss, and reputational damage for affected European entities.
Defensive guidance
1. Implement advanced email filtering and anti-phishing solutions to detect and block spear-phishing attempts, especially those targeting automotive commerce sectors. 2. Conduct targeted user awareness training focusing on phishing risks and suspicious .NET executable behavior. 3. Monitor and restrict execution of unauthorized .NET binaries and living-off-the-land binaries (LOLBins) commonly abused by this malware. 4. Deploy endpoint detection and response (EDR) tools capable of detecting suspicious process injection, credential dumping, and command and control communications. 5. Use threat intelligence feeds to block known indicators such as the identified file hashes, IP address 91.223.75.96, and domain carprlce.ru at network perimeter devices. 6. Enforce least privilege principles to limit credential access and lateral movement opportunities. 7. Regularly audit and harden persistence mechanisms to detect and remove unauthorized startup entries or scheduled tasks. 8. Establish network segmentation to isolate critical systems and monitor for unusual outbound traffic patterns. 9. Collaborate with law enforcement and share threat intelligence to stay updated on campaign developments. 10. Conduct regular incident response drills simulating phishing and malware infection scenarios relevant to this threat.
- T1566Phishing · Initial Access (opens in a new tab)
- T1047Windows Management Instrumentation · Execution (opens in a new tab)
- T1127Trusted Developer Utilities Proxy Execution · Stealth, Execution (opens in a new tab)
- T1204User Execution · Execution (opens in a new tab)
- T1547Boot or Logon Autostart Execution · Persistence, Privilege Escalation (opens in a new tab)
- Author
- AlienVault
- TLP
- white
Indicators of compromise
Domains 1
- carprlce.ru
URLs 1
- https://carprlce.ru
IP addresses 1
CC=RU ASN=AS39087 p.a.k.t llc
- 91.223.75.96
Hashes 3
- 957b34952d92510e95df02e3600b8b21
- c0adfd84dfae8880ff6fd30748150d32
- c6a6fcec59e1eaf1ea3f4d046ee72ffe
Community reviews
Related threats
- Microsoft Teams to get AI-powered, context-aware phishing detectionNews
- Technology that blocks DGA domains | Kaspersky official blogAnalysis
- 2026 Year End Phishing LuresCampaign
- Machine speed attacks require machine speed detection and responseAnalysis
- How Tenable brought multi-language support to security detectors with agentic translationAnalysis