MalwareUsed by 4 actorsExploits 2 CVEs

CosmicDuke

Also known asBotgenStudiosNemesisGeminaTinyBaron

CosmicDuke is a Windows espionage malware family within the Duke toolset associated with APT29, also known as Cozy Bear or The Dukes. It is commonly characterized as a hybrid backdoor and information stealer designed for long-term intelligence collection from compromised hosts. Reporting has linked it to the broader Duke ecosystem alongside MiniDuke, CozyDuke, SeaDuke, GeminiDuke, PinchDuke, OnionDuke, HammerDuke, and CloudDuke, and some samples and reporting connect it to the internal project name Nemesis Gemina.

CosmicDuke focuses on harvesting sensitive user and system data. Documented capabilities include theft of credentials from web browsers, email clients, instant messaging applications, and wireless network profiles; keylogging; periodic screenshot capture; clipboard collection; collection of files from local hard drives and removable media based on predefined extension or keyword lists; and general host information gathering. It also supports command-and-control communications for follow-on operator tasking, making it useful both as a surveillance implant and as a remotely managed backdoor.

Persistence mechanisms observed for CosmicDuke include abuse of Windows Scheduled Tasks and Windows services. Reported variants have created scheduled tasks and installed services masquerading as legitimate software components to survive reboots and maintain execution. Some analyzed samples also performed security-product checks before continuing, indicating basic defense-evasion logic.

CosmicDuke has been described as using custom packing and in some cases a modified RC4 implementation containing a programming flaw. It has also been observed unpacking code in memory and launching additional components, reflecting a modular architecture with loaders and optional plugins around a primary information-stealing core.

The malware has been associated with cyber-espionage activity attributed to APT29 and has been reported targeting high-value sectors including government, finance, healthcare, energy, technology, academia, media, pharmaceuticals, and think tanks. Victim geography reported for related activity includes the United States, the United Kingdom, Germany, and Japan. Overall, CosmicDuke is best understood as a mature Windows intelligence-collection platform used in targeted intrusions by the Duke espionage ecosystem.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2010-4398Windows win32k.sys RtlQueryRegistryValues Stack Buffer Overflow Privilege EscalationExploited in the wild

CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.

via mitre attackattack.mitre.org

CVE-2010-0232Windows Kernel Exception Handler Privilege Escalation in NTVDMExploited in the wild

CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.

via mitre attackattack.mitre.org

THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Office Monkeys

It has a range of malware tools at its disposal, known as the Dukes, including Cozyduke, Miniduke and Cosmicduke.

via broadcom communitycommunity.broadcom.com

EuroAPT

It has a range of malware tools at its disposal, known as the Dukes, including Cozyduke, Miniduke and Cosmicduke.

via broadcom communitycommunity.broadcom.com

APT29

It has a range of malware tools at its disposal, known as the Dukes, including Cozyduke, Miniduke and Cosmicduke.

via broadcom communitycommunity.broadcom.com

Turla

In 2014, we reported other malware used by “The Dukes”, named CosmicDuke.

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

“CosmicDuke” malware is spread through several tactics, including spear-phishing, malicious advertising, exploit kits, and others.

T1566.001Spearphishing AttachmentEvidence1

“CosmicDuke” malware is spread through several tactics, including spear-phishing, malicious advertising, exploit kits, and others.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence5

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1059.003Windows Command ShellEvidence1

MITRE ATT&CK Tactics and Techniques (Based on our analysis): Execution(TA0002) T1059.003: Command and Scripting Interpreter: Windows Command Shell

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence5

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1543.003Windows ServiceEvidence2

After this, “CosmicDuke” malware loader creates a schedule task and installs windows service to achieve persistence...

Privilege Escalation

5 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence5

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1068Exploitation for Privilege EscalationEvidence2

APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.

T1134.004Parent PID SpoofingEvidence1

MITRE ATT&CK Tactics and Techniques (Based on our analysis): Privilege Escalation(TA0004) T1134.004: Access Token Manipulation: Parent PID Spoofing

T1543.003Windows ServiceEvidence2

After this, “CosmicDuke” malware loader creates a schedule task and installs windows service to achieve persistence...

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

As shown in the below figure, this CosmicDuke variant binary file was packed by a custom [unknown] packer.

T1036MasqueradingEvidence1

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

T1134.004Parent PID SpoofingEvidence1

MITRE ATT&CK Tactics and Techniques (Based on our analysis): Privilege Escalation(TA0004) T1134.004: Access Token Manipulation: Parent PID Spoofing

Credential Access

3 techniques

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

T1555Credentials from Password StoresEvidence4

Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData

T1555.003Credentials from Web BrowsersEvidence4

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

Discovery

5 techniques

T1012Query RegistryEvidence1

This sample is a component of the CosmicDuke malware, which is obtaining the desktop details of victim systems by calling the RegQueryValueExW, RegOpenKeyExW...

T1057Process DiscoveryEvidence1

This CosmicDuke backdoor loader initially verifies any security product running in the victim system before executing the CosmicDuke malware activity by calling CreateToolhelp32Snapshot, Process32Next, and Process32First.

T1082System Information DiscoveryEvidence1

Additionally, this malware collects the computer name, keyboard layout details, what drivers are available on the victim system, etc.

T1083File and Directory DiscoveryEvidence3

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1518.001Security Software DiscoveryEvidence1

This CosmicDuke backdoor loader initially verifies any security product running in the victim system before executing the CosmicDuke malware activity... If any security product is running, this malware will be terminated...

Collection

5 techniques

T1005Data from Local SystemEvidence3

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

T1025Data from Removable MediaEvidence1

AppleSeed can find and collect data from removable media devices. APT28 backdoor may collect the entire contents of an inserted USB device. Aria-body has the ability to collect data from USB devices. BADNEWS copies files with certain extensions from USB devices to a predefined directory.

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

T1113Screen CaptureEvidence3

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

T1115Clipboard DataEvidence3

The threat actor could collect data from the clipboard by calling the below code snippet.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

MITRE ATT&CK Tactics and Techniques (Based on our analysis): Command and Control(TA0011) T1071: Application Layer Protocol

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1573Encrypted ChannelEvidence1

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

INDICATORS OF COMPROMISE

IOCs tracked for this family

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

57 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

57 SOURCESView more in app

alphahunt blogNews

May 15, 2025

LOSTKEYS: COLDRIVER’s Next-Gen Social Engineering Malware and the Evolution of Russian State Espionage Tactics

CosmicDuke is a modular espionage malware used by APT29 for long-term cyber-espionage campaigns, featuring advanced persistence and stealth capabilities.

cocomelonc githubNews

May 10, 2025

Malware development trick 47: simple Windows clipboard hijacking. Simple C example. - cocomelonc

Mentioned as malware that has used clipboard hijacking techniques.

cyble blogNews

Feb 20, 2025

Threat Actor Profile: APT29 - Cyble

An information-stealing malware family with optional persistence and privilege-escalation modules.

vulncheck blogNews

Feb 15, 2024

Reimagining How We Think About Threat Actors

CosmicDuke is a backdoor malware used by the APT29/Cozy Bear threat actor for espionage and data exfiltration.

+53 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching16

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CosmicDuke

Also known asBotgenStudiosNemesisGeminaTinyBaron