MiniDuke

MITRE ATT&CK: S0051 View on attack.mitre.org

Aliases: MiniDuke

First seen
2010-01-01 00:00:00
Malware type
downloader, backdoor, loader
Family
Malware family
Operating systems
windows
Related IoCs
2825 (2825 malicious)
Last IoC activity
2026-09-02 02:02:17
Profile updated
2026-07-07 12:43:33

Targeted industries: government-and-public-sector

Targeted regions: country_code:us country_code:ua country_code:cz country_code:ro country_code:de

Context

MiniDuke is malware that was used by APT29 from 2010 to 2015. The MiniDuke toolset consists of multiple downloader and backdoor components. The loader has been used with other MiniDuke components as well as in conjunction with CosmicDuke and PinchDuke.

Recent IoC activity

2,825 malicious indicators in Maltiverse are attributed to MiniDuke (S0051). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample 2026-04-16_43defafa994a3023bd1a38d163fa3210_cosmicduke_elex_redline-stealer_r... 2026-09-02 1
file sample 2026-04-22_5bacd101e5044ee4628940d58e898532_coinminer_cosmicduke_elex_redline... 2026-09-01 1
file sample 2026-05-24_bcaea4e07a4fd296c0b3b3f80648cafd_cosmicduke_elex_redline-stealer_r... 2026-08-30 1
file sample 2026-05-06_9dbb7a693a66667fd7ba62f70da707b2_amadey_cosmicduke_elex_glassworm_... 2026-08-30 1
file sample 2026-05-24_bb678cbbe5cae51af6a8b70524ccfbea_amadey_cosmicduke_elex_glassworm_... 2026-08-30 1
file sample 2026-05-07_f55035bcee87b1227fe410d4ef725c69_coinminer_cosmicduke_elex_redline... 2026-08-28 1
file sample 2026-03-19_85f84d25fc6881dc00e9baa3f1db3c7b_coinminer_cosmicduke_elex_redline... 2026-08-28 1
file sample 2026-05-13_e278015d6c5b98ccb195ba8702c4ac17_coinminer_cosmicduke_elex_redline... 2026-08-28 1
file sample 2026-05-25_0c7bd1b51a0d38b611408e828184fb45_coinminer_cosmicduke_elex_redline... 2026-08-28 1
file sample 2026-05-25_9a04b52c2d666f085a7abf75a67c537f_amadey_cosmicduke_elex_glassworm_... 2026-08-27 1
file sample 2026-04-05_ab04906c39edc32c3b605aa17a68df34_cosmicduke_elex_redline-stealer_r... 2026-08-26 1
file sample 2026-04-17_67e83a02f4f0d90a5460d46c45502f4e_cosmicduke_elex_redline-stealer_r... 2026-08-25 1
file sample 2026-04-08_d16e79182faea88ed5f7517b827ee574_cosmicduke_elex_redline-stealer_r... 2026-08-24 1
file sample 2026-03-28_ded10f0df048c921805fb1c62c0036af_cosmicduke_elex_redline-stealer_r... 2026-08-24 1
file sample 2026-03-30_7b82d4dfbca900c6890e9a0f6f96a9f2_cosmicduke_elex_redline-stealer_r... 2026-08-23 1
file sample 2026-03-17_98adf7a1cd112ff17f8c1a6d58d0bbd6_coinminer_cosmicduke_elex_redline... 2026-08-22 1
file sample 2026-04-11_662579394e1c3c41644404915eb515fb_cosmicduke_elex_redline-stealer_r... 2026-08-21 1
file sample 2026-04-18_98cfb0e578dff1046f5facce7d726f2d_cosmicduke_elex_redline-stealer_r... 2026-08-20 1
file sample 2026-04-20_a53f13915dfad558e5e94cee66084a94_cosmicduke_elex_redline-stealer_r... 2026-08-20 1
file sample 2026-04-05_88d93d8bc929d029a0d2b52bf6fc54fc_coinminer_cosmicduke_elex_redline... 2026-08-20 1

Detection coverage

  • 1 YARA rules
  • 257 Sigma rules

Malware & tools used

  • Dead Drop Resolver (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Fallback Channels (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Internal Proxy (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Web Protocols (attack-pattern)

Used by threat actors

  • Operation Ghost (campaign)
  • APT29 (threat-actor)

Detection rules

  • DITEKSHEN_MALWARE_Win_Miniduke (yara-rule)

Reports & references

  • secureworks.com — Iron Hemlock (report)
  • f-secure.com — Dukes Whitepaper (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • kindredsec.com — An Overview Of Public Platform C2S (report)
  • kindredsec.wordpress.com — An Overview Of Public Platform C2S (report)
  • carbonblack.com — The Dukes Of Moscow (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Miniduke (report)
  • Mandiant — Its A Kind Of Magic 1 (report)
  • circl.lu — Circl Analysisreport Miniduke Stage3 Public (report)
  • research.checkpoint.com — Native Function And Assembly Code Invocation (report)
  • cybergeeks.tech — How To Defeat The Russian Dukes A Step By Step Analysis Of Miniduke Used By Apt29 Cozy Bear (report)
  • MITRE ATT&CK — S0051 (report)

External references