Netskope Threat Labs

OnionDuke

ATP Sandbox Adv. HeuristicsAV

Description

OnionDuke is a malware family that APT29 used from 2013 to 2015 in its long running espionage operations.

Stats

First seen
February 2022
Last seen
September 2026

MITRE ATT&CK techniques

5 techniques across 4 tactics.

TA0005 Stealth

  • T1140Deobfuscate/Decode Files or Information

TA0006 Credential Access

  • T1003OS Credential Dumping

TA0011 Command and Control

TA0040 Impact

  • T1499Endpoint Denial of Service

Associated groups

Alert name variants

Alert Name
Backdoor.OnionDuke.A
Dump:Backdoor.OnionDuke.A
MemScan:Backdoor.OnionDuke.A
Win32.Backdoor.OnionDuke
Win32.Dropper.OnionDuke
Win32.Trojan.OnionDuke

Related families

MetamorfoSagerunexAgent TeslaBazarKapeka

References