F-Secure The Dukes

OnionDuke steals credentials from its victims.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).

CosmicDuke collects Windows account hashes.

CosmicDuke collects LSA secrets.

PinchDuke collects user files from the compromised host based on predefined file extensions.

GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.

GeminiDuke collects information on network settings and Internet proxy settings from the victim.

CosmicDuke uses a keylogger.

GeminiDuke collects information on running processes and environment variables from the victim.

CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.

OnionDuke uses HTTP and HTTPS for C2.

One variant of CloudDuke uses HTTP and HTTPS for C2.

CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.

MiniDuke uses HTTP and HTTPS for command and control.

GeminiDuke uses HTTP and HTTPS for command and control.

SeaDuke uses HTTP and HTTPS for C2.

PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.

PinchDuke gathers system configuration information.

GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.

PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.

GeminiDuke collects information on local user accounts from the victim.

Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.

One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.

OnionDuke uses Twitter as a backup C2.

APT29 has downloaded additional tools and malware onto compromised networks.

CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.

APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.

CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.

CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.

APT29 has used unique malware in many of their operations.

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.