MiniDuke

Description

MiniDuke is a malware toolset that APT29 used from 2010 to 2015. The toolset consists of multiple downloader and backdoor components, and its loader also worked with CosmicDuke and PinchDuke components across the wider family of tools.

Stats

First seen: February 2022
Last seen: September 2026

MITRE ATT&CK techniques

9 techniques across 3 tactics.

TA0005 Stealth

T1027Obfuscated Files or Information

TA0007 Discovery

T1082System Information Discovery
T1083File and Directory Discovery

TA0011 Command and Control

T1008Fallback Channels
T1071Application Layer Protocol
- T1071.001Web Protocols
T1090Proxy
- T1090.001Internal Proxy
T1102Web Service
- T1102.001Dead Drop Resolver
T1105Ingress Tool Transfer
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms

Associated groups

G0016APT29

Associated campaigns

C0023Operation Ghost

Alert name variants

Alert Name	Engine
Gen:Variant.MiniDuke.1	AV
Gen:Variant.MiniDuke.2	AV
Win32.Backdoor.MiniDuke	ATP Sandbox Adv. Heuristics
Win32.Dropper.MiniDuke	ATP Sandbox Adv. Heuristics

Related families

InvisiMole Bazar QakBot CHOPSTICK PlugX