Full Report
Contents Introduction Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings. Looking into the decoy-document Technical Analysis Stage 1 – Malicious LNK Script Stage 2 – Malicious .NET Implant Hunting and Infrastructure. Conclusion Seqrite Protection. IOCs MITRE ATT&CK. Authors Introduction SEQRITE Labs Research Team has recently uncovered a campaign which involves targeting Russian Automobile-Commerce […] The post Operation MotorBeacon : Threat Actor targets Russian Automotive Sector using .NET Implant appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Threat Actor: Unknown Actor (Associated with Operation MotorBeacon)
## Attribution & Identity
The threat actor or group behind this campaign is currently **unattributed** in the context provided. The specific campaign has been named **Operation MotorBeacon** by the researchers. The malware implant is dubbed **CAPI Backdoor**.
## Activity Summary
The activity centers around **Operation MotorBeacon**, a campaign discovered on October 3rd, 2025, that targets the Russian Automotive and E-Commerce sectors. The operation uses spear-phishing via malicious ZIP archives containing decoy documents (related to payroll/tax changes) designed to lure victims into executing a malicious .NET DLL implant (CAPI Backdoor). The actor has been observed redirecting a fake domain to an original C2 infrastructure over tracking period.
## Tactics, Techniques & Procedures
- **Initial Access:** Spearphishing with malicious attachments (ZIP containing LNK file). (T1566.001)
- **Execution:** User execution via a malicious LNK file (T1204.002) leveraging the LOLBIN `rundll32.exe` to execute an export function (`config`) within a DLL. (T1218.011)
- **Persistence:** The implant is used to establish persistence for future malicious activities.
- **Discovery/Collection:** Uses WMI for discovery (T1047) and file/directory discovery (T1083). It also performs screen capture (T1113) and steals credentials from web browsers (T1555.003).
- **C2/Exfiltration:** Utilizes web protocols for C2 communication (T1071.001) and exfiltrates stolen data over the C2 channel (T1041).
- **Defense Evasion:** Attempts to hide artifacts/data (T1564.001).
## Targeting
- **Sectors:** Automobile Industry, E-Commerce Industry (specifically commercial and automobile-oriented transactions).
- **Geography:** Russian Federation.
- **Victims:** Organizations within the Russian Automobile Sector.
## Tools & Infrastructure
- **Malware families used:** CAPI Backdoor (.NET DLL implant, filename observed as `adobe.dll` or `client6.dll`).
- **Infrastructure (C2, domains, IPs - defang URLs):**
- Initial malicious domain: carprlce[.]ru (typosquatting legitimate carprice[.]ru).
- Observed C2 IP: 91.223[.]75[.]96
- Infrastructure 1 (Initial DGA/Redirect): Hosted under ASN AS-REG (AS197695).
- Infrastructure 2 (Exfiltration/Callback): Hosted under P.a.k.t LLC (ASN 39087).
- The implant was hosted on port 443 at one point.
## Implications
The threat actor is focused on financially motivated data theft (stealing browser credentials) and reconnaissance within the strategically important Russian automotive and e-commerce supply chain. The use of a complex, multi-stage infection focusing on LNK execution, LOLBIN abuse, and a custom .NET implant suggests a degree of sophistication aimed at bypassing automated defenses.
## Mitigations
- Enhanced scrutiny of emails containing ZIP archives, especially those leveraging legitimate-sounding themes like payroll or tax changes.
- Implement controls to restrict or monitor the execution of `rundll32.exe` with non-standard arguments, particularly those loading external DLLs.
- Monitor for network connections attempting to resolve or contact the observed DGA/typosquatted domains.
- Proactive hunting for hidden files and directories, and API calls related to WMI usage for reconnaissance.