MiniDuke

S0051

About this malware

MiniDuke is malware that was used by APT29 from 2010 to 2015. The MiniDuke toolset consists of multiple downloader and backdoor components. The loader has been used with other MiniDuke components as well as in conjunction with CosmicDuke and PinchDuke.

Techniques used9

Procedure examples9

Technique	Procedure example
T1008 Fallback Channels	MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working. Securelist MiniDuke Feb 2013
T1027 Obfuscated Files or Information	MiniDuke can use control flow flattening to obscure code. ESET Dukes October 2019
T1071.001 Web Protocols	MiniDuke uses HTTP and HTTPS for command and control. ESET Dukes October 2019 F-Secure The Dukes
T1082 System Information Discovery	MiniDuke can gather the hostname on a compromised machine. ESET Dukes October 2019
T1083 File and Directory Discovery	MiniDuke can enumerate local drives. ESET Dukes October 2019
T1090.001 Internal Proxy	MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines. ESET Dukes October 2019
T1102.001 Dead Drop Resolver	Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds. ESET Dukes October 2019 F-Secure The Dukes Securelist MiniDuke Feb 2013
T1105 Ingress Tool Transfer	MiniDuke can download additional encrypted backdoors onto the victim via GIF files. ESET Dukes October 2019 Securelist MiniDuke Feb 2013
T1568.002 Domain Generation Algorithms	MiniDuke can use DGA to generate new Twitter URLs for C2. ESET Dukes October 2019

Groups that use it1

APT29

Campaigns1

Operation Ghost

References1

F-Secure The Dukes Open source
F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.