New .NET CAPI Backdoor Targets Russian-Speaking Victims in Espionage Campaign

A new sophisticated backdoor malware targeting Russian-speaking victims has been uncovered, leveraging the .NET Cryptographic API (CAPI) to evade detection and maintain persistence. This espionage campaign highlights the increasing use of advanced techniques by threat actors to infiltrate sensitive networks and steal valuable information. The backdoor, disguised within legitimate .NET applications, exploits cryptographic functions to securely communicate with command and control servers, making traditional detection methods less effective. Security researchers emphasize the importance of updated endpoint protection and network monitoring to identify and mitigate such threats. Organizations operating in geopolitically sensitive regions, especially those dealing with Russian entities, should be particularly vigilant. This campaign underscores the evolving landscape of cyber espionage where attackers continuously refine their tools and tactics to bypass defenses and achieve their objectives. Enhanced threat intelligence sharing and proactive cybersecurity measures remain critical in defending against these sophisticated intrusions.

This Cyber News was published on thehackernews.com. Publication date: Mon, 20 Oct 2025 00:44:02 +0000


Cyber News related to New .NET CAPI Backdoor Targets Russian-Speaking Victims in Espionage Campaign

CVE-2023-53109 - In the Linux kernel, the following vulnerability has been resolved: ...
6 months ago
CVE-2024-26633 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
CVE-2025-21707 - In the Linux kernel, the following vulnerability has been resolved: ...
8 months ago
CVE-2024-36886 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
CVE-2024-26857 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
CVE-2024-35893 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
CVE-2024-47685 - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use ...
1 year ago Tenable.com
CVE-2024-58071 - In the Linux kernel, the following vulnerability has been resolved: ...
8 months ago
New .NET CAPI Backdoor Targets Russian-Speaking Victims in Espionage Campaign - A new sophisticated backdoor malware targeting Russian-speaking victims has been uncovered, leveraging the .NET Cryptographic API (CAPI) to evade detection and maintain persistence. This espionage campaign highlights the increasing use of advanced ...
3 weeks ago Thehackernews.com
CVE-2024-42106 - In the Linux kernel, the following vulnerability has been resolved: ...
10 months ago
CVE-2025-37961 - In the Linux kernel, the following vulnerability has been resolved: ...
5 months ago
CVE-2025-21959 - In the Linux kernel, the following vulnerability has been resolved: ...
7 months ago
CVE-2025-38491 - In the Linux kernel, the following vulnerability has been resolved: ...
3 months ago
CVE-2024-50083 - In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending ...
1 year ago Tenable.com
CVE-2024-26781 - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Syzbot and Eric reported a lockdep splat in the subflow diag: WARNING: possible circular locking dependency detected ...
1 year ago Tenable.com
CVE-2023-52784 - In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. ...
1 year ago Tenable.com
Who is the DOGE and X Technician Branden Spikes? – Krebs on Security - Branden Spikes California Russian Association Congress of Russian Americans Constellation of Humanity Cyberinc Department of Government Efficiency Diana Fishman Donald J. Prior to founding Spikes Security, Branden Spikes was married to a native ...
8 months ago Krebsonsecurity.com
CVE-2024-57802 - In the Linux kernel, the following vulnerability has been resolved: netrom: check buffer length before accessing it Syzkaller reports an uninit value read from ax25cmp when sending raw message through ieee802154 implementation. ...
9 months ago Tenable.com
CVE-2025-21858 - In the Linux kernel, the following vulnerability has been resolved: ...
8 months ago
CVE-2024-50035 - In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is ...
1 year ago Tenable.com
CVE-2025-21716 - In the Linux kernel, the following vulnerability has been resolved: ...
8 months ago
CVE-2022-48956 - In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6_fragment() Blamed commit claimed rcu_read_lock() was held by ip6_fragment() callers. It seems to not be always true, at least for UDP stack. syzbot ...
1 year ago Tenable.com
CVE-2025-38476 - In the Linux kernel, the following vulnerability has been resolved: ...
3 months ago
BianLian GOs for PowerShell After TeamCity Exploitation - In conjunction with GuidePoint's DFIR team, we responded to an incident that began with the exploitation of a TeamCity server which resulted in the deployment of a PowerShell implementation of BianLian's GO backdoor. The threat actor identified a ...
1 year ago Securityboulevard.com CVE-2024-27198 CVE-2023-42793 BianLian
CVE-2024-50033 - In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the ...
1 year ago Tenable.com

Cyber Trends (last 7 days)