CosmicDuke

ATP Sandbox Adv. Heuristics

Description

CosmicDuke is a malware family that APT29 used from 2010 to 2015 as part of its toolset.

Stats

First seen: March 2022
Last seen: September 2026

Also known as

CosmicdukeTinybaron

MITRE ATT&CK techniques

19 techniques across 8 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0004 Privilege Escalation

T1068Exploitation for Privilege Escalation

TA0006 Credential Access

T1003OS Credential Dumping
- T1003.004LSA Secrets
- T1003.002Security Account Manager
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1083File and Directory Discovery

TA0009 Collection

T1005Data from Local System
T1025Data from Removable Media
T1039Data from Network Shared Drive
T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture
T1114Email Collection
- T1114.001Local Email Collection
T1115Clipboard Data

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1020Automated Exfiltration
T1048Exfiltration Over Alternative Protocol
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Associated groups

G0016APT29

Alert name variants

Alert Name	Engine
Script-WScript.Backdoor.Tinybaron	ATP Sandbox Adv. Heuristics
Win32.Backdoor.CosmicDuke	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Tinybaron	ATP Sandbox Adv. Heuristics
Win32.Infostealer.CosmicDuke	ATP Sandbox Adv. Heuristics
Win32.Trojan.Cosmicduke	ATP Sandbox Adv. Heuristics

Related families

Empire Machete InvisiMole KONNI QakBot

References