CosmicDuke

Malware & Tools · CosmicDuke

· MalwareS0050 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

CosmicDuke is malware that was used by APT29 from 2010 to 2015. (Citation: F-Secure The Dukes)

Tactic Coverage

collection (7)credential access (5)privilege escalation (3)exfiltration (2)persistence (2)command and control (2)execution (1)discovery (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (19)

T1003.002Security Account Manager

credential access

T1003.004LSA Secrets

credential access

T1005Data from Local System

collection

T1020Automated Exfiltration

exfiltration

T1025Data from Removable Media

collection

T1039Data from Network Shared Drive

collection

T1048.003

References

https://attack.mitre.org/software/S0050 https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf

Exfiltration Over Unencrypted Non-C2 Protocol

T1053.005Scheduled Task

executionpersistence

T1056.001Keylogging

collectioncredential access

T1068Exploitation for Privilege Escalation

privilege escalation

T1071.001Web Protocols

command and control

T1083File and Directory Discovery

discovery

T1113Screen Capture

collection

T1114.001Local Email Collection

collection

T1115Clipboard Data

collection

T1543.003Windows Service

persistenceprivilege escalation

T1555Credentials from Password Stores

credential access

T1555.003Credentials from Web Browsers

credential access

T1573.001Symmetric Cryptography

command and control