Sophisticated Kapeka Backdoor Attack Victims in Europe

Researchers have discovered a novel backdoor malware named Kapeka targeting Eastern European organizations since mid-2022, which grants initial access and long-term persistence within the victim’s network. 

The targeted attacks, coupled with Kapeka’s low detection rate and advanced functionalities, suggest APT-level (Advanced Persistent Threat) activity, which implies a highly skilled group likely behind the attacks, potentially aiming for espionage or sabotage. 

A novel backdoor tool, Kapeka, used by the APT group Sandworm, which is a Russian state-sponsored actor affiliated with the GRU, is known for its cyberattacks against Ukraine. 

The technical linkages have been found between Kapeka and GreyEnergy, another sandworm malware, suggesting Kapeka might be its successor. 

Kapeka’s deployment coincided with Prestige ransomware attacks targeting the Ukrainian and Polish transportation sectors, which were attributed to Sandworm, suggesting that Sandworm is adopting Kapeka as a new tool for potential espionage and subsequent ransomware deployment. 

Sandworm, a hacker group likely affiliated with Russia’s GRU intelligence agency, is deploying a new backdoor called Kapeka, which infects target machines through a dropper component that self-destructs after installation. 

The backdoor then gathers information about the infected system and user before exfiltrating it to the attackers and the stolen data allows Sandworm to remotely issue commands to the compromised machine or update Kapeka’s configuration. 

The emergence of Kapeka coincides with the Russia-Ukraine war, suggesting its use in targeted attacks against Central and Eastern European organizations since 2022. 

Given that Kapeka resembles GreyEnergy, a former Sandworm backdoor, it is likely that GreyEnergy itself was a replacement for BlackEnergy, another piece of malware that Sandworm used. 

The technical analysis report details Kapeka’s functionalities and its potential link to Sandworm’s Prestige ransomware deployment in late 2022. The report aims to inform security researchers, businesses, and governments about this potential new threat. 

WithSecure shared a security report in advance with governments and select clients with details about a new cyber threat. There are also a number of tools released along with the report to help in locating and analyzing systems that could be vulnerable to this threat. 

The tools include an extractor for malicious configurations, a script to decrypt and simulate the attacker’s network traffic, and indicators of compromise (IOCs) to detect infected systems.