CapFix Uses Evolving CapDoor Malware in Attacks on Russian Organizations

Apr 21, 2026 · Original article ↗

Summary

Positive Technologies details CapFix campaigns targeting Russian industrial and aviation organizations with phishing lures, compromised infrastructure and evolving CapDoor malware capable of executing commands, downloading payloads and capturing screenshots.

Key points

The researchers detected CapFix campaigns targeting Russian organizations, including industrial and aviation companies, from late 2025 through March 2026.
Phishing PDFs and HTML files prompted victims to download malicious archives; the attacks used CHM scripts and MSI installers disguised as legitimate software.
CapFix used compromised legitimate infrastructure for delivery and command-and-control. Researchers suspect access may have involved the critical Roundcube vulnerability CVE-2025-49113.
Recent CapDoor versions use a multistage DLL sideloading chain to load shellcode, establish persistence through a Windows autorun registry key and communicate with C2 servers.
CapDoor can run PowerShell commands, download and execute files, and capture screenshots; payloads observed alongside it included SectopRAT and ArechClient2.
The report describes the malware’s evolution and links earlier campaigns to cryptocurrency and hotel-booking lures using ClickFix; the researchers say the AsyncRAT campaigns cannot be definitively attributed to CapFix.

Article Details

Attack Vectors: Phishing PDFs linked to RAR archives hosted on compromised legitimate sites. The archives contained scripts or installers that deployed CapDoor.
Mass-mailed phishing emails targeted aviation companies, manufacturing companies, and an educational institution. Some lures impersonated Russian government structures.
Malicious HTML files displayed apparently legitimate documents and prompted users to download additional files to unlock them.
Earlier activity used cryptocurrency-themed files and hotel-booking phishing pages employing ClickFix. The researchers consider the attribution of the AsyncRAT-based ClickFix attacks to CapFix probable, not definitive.
The researchers suspect the attackers gained access to compromised mail infrastructure through CVE-2025-49113 in Roundcube Webmail; they did not confirm the intrusion method.
CapDoor was launched through a multistage DLL-sideloading chain involving a legitimate signed executable and encrypted payload files.
Defensive Notes: Positive Technologies lists PT Sandbox, PT AV, and PT EDR verdicts or behavioral rules for CapDoor-related files and behavior, including DLL side-loading and Windows autorun modification.
The article lists network verdicts for CapDoor check-ins and SectopRAT.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`andreiushakov[.]ru`	Domain tied by the researchers to the phishing-email actor; they observed no attacks originating from it.
DOMAIN	`booking[.]fleps-extranet[.]com`	Malicious ClickFix domain reached through an attacker-used GitHub Pages redirect.
DOMAIN	`booking[.]l-extranet[.]com`	Malicious hotel-booking-themed domain used in an AsyncRAT ClickFix campaign whose attribution to CapFix is not definitive.
DOMAIN	`ddmmitriypetrovv[.]ru`	Domain used to send the attackers' mass phishing emails.
DOMAIN	`documents-sed[.]com`	Additional domain the researchers linked to the threat actor through its registration.
DOMAIN	`leonidkalatov[.]ru`	Domain tied by the researchers to the phishing-email actor; they observed no attacks originating from it.
DOMAIN	`microsoftpathes[.]com`	Windows-update-themed domain tied to the email address used to register an attacker-controlled CapDoor C2 domain.
DOMAIN	`securityswindows[.]com`	Windows-update-themed domain tied to the email address used to register an attacker-controlled CapDoor C2 domain.
DOMAIN	`sed-documents[.]com`	Additional domain the researchers linked to the threat actor through its registration.
DOMAIN	`support-archiver[.]com`	Domain that delivered a RAR archive containing an MSI that ultimately installed CapDoor.
DOMAIN	`windowsextupdates[.]com`	Attacker-controlled domain used for CapDoor C2 communications and later for payload delivery.
EMAIL	`salasunion@onionmail[.]org`	Email address used to register additional domains linked to the threat actor.
EMAIL	`virrtasuin93@onionmail[.]org`	Email address the attackers used to register Windows-update-themed domains, including a CapDoor C2 domain.
IPV4	`85[.]192[.]49[.]81`	C2 server contacted by CapDoor samples; the article also links it to earlier AsyncRAT ClickFix activity.
IPV4	`94[.]156[.]232[.]113`	C2 server contacted by CapDoor samples.
SHA256	`23f693029d8e00999a1c0e68d72884fd55f874582780afb94dbb1d3f8fb07f38`	SHA-256 of a malicious PDF that linked to an archive on a compromised site.
URL	`hxxps[:]//windowsextupdates[.]com/updates/latest/q/Document[.]rar`	Attacker-controlled URL used to download a malicious archive in the March 2026 attacks.