What This Report Covers
Kapeka is a Windows backdoor installed by a dropper, built to give attackers long-term access to a system. This report ties it to Sandworm, which MITRE ATT&CK describes as attributed to Russia’s GRU military unit 74455.
The analysis covers how the backdoor profiles the infected machine and its user, creates extra files to run payloads sent by the attacker, removes existing malware installations and configurations, and returns collected data to a remote server using RSA.
Its rarity and secrecy point to operations at the level of an advanced persistent threat. See the Kapeka article and the Sandworm profile.
The report is meant for analysts who track Sandworm tooling and for teams that need to recognize the files the backdoor leaves behind. It also helps defenders judge how a quiet backdoor supports long-term access in a high-value target.
The Kapeka backdoor is a C++ backdoor that has targeted Eastern Europe since mid-2022. MITRE ATT&CK describes it as able to run Windows commands, collect system information, use HTTP for command and control, and persist through scheduled tasks and registry changes. MITRE ATT&CK notes that researchers associate it with Sandworm Team. This page introduces the Brandefense report on its technical details, detections and indicators of compromise. Related reading: the Infamous Chisel malware page.
What Will You Find in This Kapeka Backdoor Report?
Learn Technical Method of Operation Details
The technical details of the Kapeka Backdoor and more about Sandworm threat actor. The report will show many points about the its technical details, detections, and IoCs.
Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic.