ESET Dukes October 2019

During Operation Ghost, APT29 used steganography to hide the communications between the implants and their C&C servers.

FatDuke can copy files and directories from a compromised host.

FatDuke has used several C2 servers per targeted organization.

FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.

LiteDuke can query the Registry to check for the presence of HKCU\Software\KasperskyLab.

LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.

FatDuke can identify the MAC address on the target computer.

MiniDuke can use control flow flattening to obscure code.

FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.

PolyglotDuke can custom encrypt strings.

RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.

LiteDuke has been packed with multiple layers of encryption.

FatDuke has been regularly repacked by its operators to create large binaries and evade detection.

LiteDuke has used image files to hide its loader component.

PolyglotDuke can use steganography to hide C2 information in images.

During Operation Ghost, APT29 used steganography to hide payloads inside valid images.

RegDuke can hide data in images, including use of the Least Significant Bit (LSB).

RegDuke can store its encryption key in the Registry.

PolyglotDuke can store encrypted JSON configuration files in the Registry.

FatDuke has been packed with junk code and strings.

LiteDuke can enumerate the account name on a targeted system.

FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.

FatDuke can list running processes on the localhost.

FatDuke has the ability to execute PowerShell scripts.

RegDuke can extract and execute PowerShell scripts from C2 communications.

FatDuke can secure delete its DLL.

LiteDuke can securely delete files by first writing random data to the file.

MiniDuke uses HTTP and HTTPS for command and control.

LiteDuke can use HTTP GET requests in C2 communications.

FatDuke can be controlled via a custom C2 protocol over HTTP.

PolyglotDuke has has used HTTP GET requests in C2 communications.

For Operation Ghost, APT29 used stolen administrator credentials for lateral movement on compromised networks.

FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.

MiniDuke can gather the hostname on a compromised machine.

LiteDuke can enumerate the CPUID and BIOS version on a compromised system.

MiniDuke can enumerate local drives.

FatDuke can enumerate directories on target machines.

FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.

MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.

PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.

Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.

RegDuke can use Dropbox as its C2 server.

For Operation Ghost, APT29 used social media platforms to hide communications to C2 servers.

LiteDuke has the ability to download files.

RegDuke can download files from C2.

MiniDuke can download additional encrypted backdoors onto the victim via GIF files.

PolyglotDuke can retrieve payloads from the C2 server.

FatDuke can call ShellExecuteW to open the default browser on the URL localhost.

PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.

RegDuke can create seemingly legitimate Registry key to store its encryption key.