MiniDuke
MITRE ATT&CK: S0051 View on attack.mitre.org
Aliases: MiniDuke
- First seen
- 2010-01-01 00:00:00
- Malware type
- downloader, backdoor, loader
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 2851 (2849 malicious)
- Last IoC activity
- 2026-10-18 02:41:38
- Profile updated
- 2026-07-07 12:43:33
Targeted industries: government-and-public-sector
Targeted regions: country_code:us country_code:ua country_code:cz country_code:ro country_code:de
Context
MiniDuke is malware that was used by APT29 from 2010 to 2015. The MiniDuke toolset consists of multiple downloader and backdoor components. The loader has been used with other MiniDuke components as well as in conjunction with CosmicDuke and PinchDuke.
Recent IoC activity
2,849 malicious indicators in Maltiverse are attributed to MiniDuke (S0051). The 20 most recently updated:
Detection coverage
- 1 YARA rules
- 257 Sigma rules
Malware & tools used
- Dead Drop Resolver (attack-pattern)
- System Information Discovery (attack-pattern)
- Domain Generation Algorithms (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- Fallback Channels (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Internal Proxy (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Web Protocols (attack-pattern)
Used by threat actors
- Operation Ghost (campaign)
- APT29 (threat-actor)
Detection rules
- DITEKSHEN_MALWARE_Win_Miniduke (yara-rule)
Reports & references
- secureworks.com — Iron Hemlock (report)
- f-secure.com — Dukes Whitepaper (report)
- ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Miniduke (report)
- Mandiant — Its A Kind Of Magic 1 (report)
- circl.lu — Circl Analysisreport Miniduke Stage3 Public (report)
- research.checkpoint.com — Native Function And Assembly Code Invocation (report)
- cybergeeks.tech — How To Defeat The Russian Dukes A Step By Step Analysis Of Miniduke Used By Apt29 Cozy Bear (report)
- MITRE ATT&CK — S0051 (report)
- kindredsec.com — An Overview Of Public Platform C2S (report)
- kindredsec.wordpress.com — An Overview Of Public Platform C2S (report)
- carbonblack.com — The Dukes Of Moscow (report)