PolyglotDuke

Malware & Tools · PolyglotDuke

· MalwareS0518 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

PolyglotDuke is a downloader that has been used by APT29 since at least 2013. PolyglotDuke has been used to drop MiniDuke.(Citation: ESET Dukes October 2019)

Tactic Coverage

stealth (5)command and control (3)execution (1)defense impairment (1)persistence (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (10)

T1027Obfuscated Files or Information

stealth

T1027.003Steganography

stealth

T1027.011Fileless Storage

stealth

T1071.001Web Protocols

command and control

T1102.001Dead Drop Resolver

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

References

https://attack.mitre.org/software/S0518 https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf