Kapeka

Description

Kapeka is a backdoor written in C++ used against victims in Eastern Europe since at least mid 2022. It has technical overlaps with the Exaramel and Prestige malware variants linked to the Sandworm threat actor, and researchers assess operators may have used it ahead of Prestige deployments in late 2022.

Stats

First seen: April 2024
Last seen: October 2026

Also known as

KnuckleTouch

MITRE ATT&CK techniques

14 techniques across 5 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.008Masquerade File Type
T1070Indicator Removal
- T1070.009Clear Persistence
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.011Rundll32

TA0007 Discovery

T1012Query Registry
T1082System Information Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1090Proxy
T1132Data Encoding
- T1132.001Standard Encoding

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0034Sandworm Team

Alert name variants

Alert Name	Engine
Trojan.Kapeka.B	AV
Trojan.Kapeka.C	AV
Win32.Dropper.KnuckleTouch	ATP Sandbox Adv. Heuristics
Win64.Backdoor.KnuckleTouch	ATP Sandbox Adv. Heuristics
Win64.Trojan.Kapeka	ATP Sandbox Adv. Heuristics

Related families

Bisonal QakBot PlugX Bazar njRAT