---
title: VooDoo Bear's Kapeka Backdoor Targets Critical Infrastructure
description: WithSecure recently reported on Kapeka, also known as KnuckleTouch, a novel backdoor used by VooDoo Bear to target entities in Eastern Europe.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [VooDoo Bear's Kapeka Backdoor Targets Critical Infrastructure](https://blog.polyswarm.io/voodoo-bears-kapeka-backdoor-targets-critical-infrastructure)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Apr 26, 2024 6:28:37 PM

**Related Families:** GreyEnergy, Prestige  
**Verticals Targeted:** Critical Infrastructure

## **Executive Summary**

## Kapeka, also known as KnuckleTouch, is a novel backdoor used by VooDoo Bear to target entities in Eastern Europe.

**Key Takeaways**

- Kapeka, also known as KnuckleTouch, is a novel backdoor used by VooDoo Bear to target entities in Eastern Europe.
- Kapeka is a flexible backdoor written in C++. 
- Kapeka allows the threat actors to use it as an early stage toolkit, while also providing long term persistence to the victim network. 
- Kapeka was likely created to target the opposition in the ongoing Russia-Ukraine conflict.
- Kapeka is likely a successor to GreyEnergy.
- VooDoo Bear is a Russia nexus threat actor group thought to be affiliated with GRU Unit 74455.

**What is Kapeka?**

### Kapeka, also known as KnuckleTouch, is a novel backdoor used by VooDoo Bear to target entities in Eastern Europe. Kapeka was active as early as mid-2022 and was used in a limited number of presumably targeted attacks. WithSecure recently [reported](https://labs.withsecure.com/publications/kapeka) on Kapeka. 

Kapeka, which means “little stork” in Russian,  is a flexible backdoor written in C++. It allows the threat actors to use it as an early stage toolkit, while also providing long term persistence to the victim network. Kapeka’s dropper is a 32-bit Windows executable that drops and launches the backdoor on a victim machine. The dropper also sets up persistence by creating a scheduled task or autorun registry. Finally, the dropper removes itself from the system. 

The backdoor, which is a DLL, targets both 32-bit and 64-bit Windows environments. It gathers information and fingerprints the user and the machine, then sends the information to the threat actor-controlled C2. The backdoor uses a multi-threaded approach, and leverages event objects for data synchronization and signaling across threads.

WithSecure noted overlaps between Kapeka and other tools in VooDoo Bear’s arsenal, including GreyEnergy and Prestige ransomware. Kapeka was likely created to target the opposition in the ongoing Russia-Ukraine conflict. It is possible Kapeka was used to deploy Prestige ransomware. WithSecure also noted Kapeka is likely a successor to GreyEnergy, which was the successor to BlackEnergy. 

**Who is VooDoo Bear?**

VooDoo Bear, also known as Sandworm, BlackEnergy, Seashell Blizzard, Quedagh, Telebots, and Iron Viking, is a Russia nexus threat actor group active since at least 2011. The group is thought to be affiliated with GRU Unit 74455. VooDoo Bear has a history of attacks targeting ICS and critical infrastructure systems. They were allegedly responsible for the 2015 and 2016 cyberattacks on the Ukrainian power grid, the 2017 NotPetya attacks, and Cyclops Blink.

VooDoo Bear TTPs include but are not limited to phishing, password spraying, masquerading as other threat actors, credential dumping, defacement, wipers, BlackEnergy, GreyEnergy, GCat, NotPetya, VPNFilter, CHEMISTGAMES, Exaramel, Olympic Destroyer, PassKillDisk, Cyclops Blink, CaddyWiper, ORCSHRED, SOLOSHRED, AWFULSHRED, Industroyer, Industroyer2, Prestige ransomware, and AcidPour. 

**IOCs**

PolySwarm has multiple samples of Kapeka.

 

[bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f](https://polyswarm.network/scan/results/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f)

[272cfaebf22e0f6a34c0a93b7c9c5b67c725947ba0f17e60ed67dbf6e1602043](https://polyswarm.network/scan/results/file/272cfaebf22e0f6a34c0a93b7c9c5b67c725947ba0f17e60ed67dbf6e1602043)

[f30b9f6e913798ca52154c88725ee262a7bf92fe7caac1ae2e5147e457b9b08a](https://polyswarm.network/scan/results/file/f30b9f6e913798ca52154c88725ee262a7bf92fe7caac1ae2e5147e457b9b08a)

 

You can use the following CLI command to search for all Kapeka samples in our portal:

**$ polyswarm link list -f Kapeka**

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) *|* [Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

[View full post](https://blog.polyswarm.io/voodoo-bears-kapeka-backdoor-targets-critical-infrastructure)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2024-04-26T18:28:37.183Z",
  "datePublished" : "2024-04-26T18:28:37Z",
  "headline" : "VooDoo Bear's Kapeka Backdoor Targets Critical Infrastructure",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/VOODOOBEAR.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/voodoo-bears-kapeka-backdoor-targets-critical-infrastructure",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```