Kapeka
- ID
- S1190
- Type
- Malware
- Associated names
- KnuckleTouch
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 11 Mar 2025
Kapeka is a backdoor written in C++ used against victims in Eastern Europe since at least mid-2022. Kapeka has technical overlaps with Exaramel for Windows and Prestige malware variants, both of which are linked to Sandworm Team. Kapeka may have been used in advance of Prestige deployment in late 2022.[1][2]
Techniques used (14)
- T1012 Query Registry
- T1027.013 Encrypted/Encoded File
- T1036.008 Masquerade File Type
- T1053.005 Scheduled Task
- T1059.003 Windows Command Shell
- T1070.009 Clear Persistence
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1090 Proxy
- T1106 Native API
- T1112 Modify Registry
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1218.011 Rundll32