Russian APT Deploys New 'Kapeka' Backdoor in Eastern European Attacks

The report details Kapeka, a flexible Windows DLL backdoor observed since mid-2022 targeting Eastern Europe and attributed to the Russia-linked APT Sandworm; it uses a dropper that establishes persistence (scheduled task or autorun), communicates with actor-controlled C2 servers via WinHttp/JSON, supports file read/write, command execution, payload launches, on-the-fly C2 updates, and has been linked to ransomware campaigns (including probable ties to Prestige) while leveraging living-off-the-land tooling (certutil).