CosmicDuke
MITRE ATT&CK: S0050 View on attack.mitre.org
Aliases: TinyBaron, BotgenStudios, NemesisGemina, CosmicDuke
- First seen
- 2010-01-01 00:00:00
- Malware type
- credential-stealer, spyware, backdoor
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 2030 (2027 malicious)
- Last IoC activity
- 2026-10-18 01:39:16
- Profile updated
- 2026-07-07 13:20:32
Targeted industries: government-and-public-sector energy-and-utilities technology-and-telecommunications
Targeted regions: country_code:us country_code:fi country_code:ge country_code:pl
Context
CosmicDuke is malware that was used by APT29 from 2010 to 2015.
Recent IoC activity
2,030 malicious indicators in Maltiverse are attributed to CosmicDuke (S0050). The 20 most recently updated:
Detection coverage
- 1 YARA rules
- 242 Sigma rules
Malware & tools used
- Windows Service (attack-pattern)
- LSA Secrets (attack-pattern)
- Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
- Data from Network Shared Drive (attack-pattern)
- Credentials from Password Stores (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Exploitation for Privilege Escalation (attack-pattern)
- Clipboard Data (attack-pattern)
- Keylogging (attack-pattern)
- Screen Capture (attack-pattern)
- Web Protocols (attack-pattern)
- Local Email Collection (attack-pattern)
- Security Account Manager (attack-pattern)
- Automated Exfiltration (attack-pattern)
- Data from Local System (attack-pattern)
- Scheduled Task (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Data from Removable Media (attack-pattern)
Used by threat actors
- APT29 (threat-actor)
Detection rules
- MALPEDIA_Win_Cosmicduke_Auto (yara-rule)
Reports & references
- f-secure.com — Dukes Whitepaper (report)
- MITRE ATT&CK — S0050 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Cosmicduke (report)
- cyfirma.com — Cosmicduke Malware Analysis (report)
- blog.f-secure.com — Cosmicduke (report)
- cocomelonc.github.io — Malware Tricks 47 (report)