Capibar

Capibar, a new malware identified as part of the arsenal of the Russian-based threat group Turla (also known as Pensive Ursa, Uroburos, or Snake), has been used in recent cyberattacks. This group, linked to the Russian Federal Security Service (FSB) and active since at least 2004, has deployed Capibar alongside other tools such as Kazuar, Snake, QUIETCANARY/Tunnus, Crutch, ComRAT, Carbon, HyperStack, and TinyTurla. The Ukrainian Computer Emergency Response Team (CERT-UA) reported in July 2023 that Turla was using Capibar and Kazuar for espionage attacks on Ukrainian defense assets. Notably, Capibar is unique in its ability to transform Microsoft Exchange servers into command and control servers. In these targeted attacks, Capibar serves as a first-stage backdoor, while other tools like Kazuar are used for additional stages of the attack. The multi-staged delivery mechanism of Kazuar, along with other tools such as Capibar, was unveiled by a recent campaign reported by CERT-UA. In this specific campaign, Capibar was primarily used for intelligence gathering, while Kazuar performed credential theft. The scheduled task downloads the Capibar malware for the deployment of malicious payloads and execution of received commands. Both Microsoft Threat Intelligence and CERT-UA have issued warnings about Turla's recent attacks targeting the defense industry and Microsoft Exchange servers using Capibar, also known as DeliveryCheck and Gameday. Alerts for prevention and detection have been raised for each malware type, including Capibar and Kazuar. It is essential to remain vigilant against these threats, which can infiltrate systems through suspicious downloads, emails, or websites, potentially leading to significant data loss, operational disruption, or personal information theft.