MiniDuke
ID: S0051
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.3
Created: 31 May 2017
Last Modified: 14 October 2021
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
| Enterprise | T1568 | .002 | Dynamic Resolution: Domain Generation Algorithms |
MiniDuke can use DGA to generate new Twitter URLs for C2.[2] |
| Enterprise | T1008 | Fallback Channels |
MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.[3] |
|
| Enterprise | T1083 | File and Directory Discovery | ||
| Enterprise | T1105 | Ingress Tool Transfer |
MiniDuke can download additional encrypted backdoors onto the victim via GIF files.[3][2] |
|
| Enterprise | T1027 | Obfuscated Files or Information |
MiniDuke can use control flow flattening to obscure code.[2] |
|
| Enterprise | T1090 | .001 | Proxy: Internal Proxy |
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.[2] |
| Enterprise | T1082 | System Information Discovery |
MiniDuke can gather the hostname on a compromised machine.[2] |
|
| Enterprise | T1102 | .001 | Web Service: Dead Drop Resolver |
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.[1][3][2] |
Groups That Use This Software
Campaigns
| ID | Name | Description |
|---|---|---|
| C0023 | Operation Ghost |
For Operation Ghost, APT29 used MiniDuke as a second-stage backdoor.[2] |