Loading malware…
MiniDuke is a Windows backdoor platform associated with the Dukes espionage cluster, also tracked as APT29 or Cozy Bear and widely linked to Russia’s SVR. Active since at least 2013 and used through at least 2019, MiniDuke has appeared as part of a staged intrusion toolset that includes downloader, loader, and backdoor components, and it has served as a second-stage implant in long-running diplomatic espionage operations such as Operation Ghost. Victimology has centered on high-value government and diplomatic organizations, including ministries of foreign affairs and embassies, with reporting indicating an emphasis on organizational networks rather than consumer targets.
MiniDuke backdoor samples are notable for compact low-level implementation, including variants written in pure assembly, and for extensive obfuscation and encrypted or hashed API resolution. Documented samples communicate over HTTP using WinINet and support broad remote administration functions, including file and directory management, process execution and termination, host profiling, drive enumeration, timestamp and uptime collection, and transfer of data to and from the infected system. Some variants can create processes under supplied credentials, enabling post-compromise operations in domain environments. Analysis of later samples also showed memory cleanup intended to reduce recoverable forensic artifacts.
The malware’s command-and-control tradecraft emphasizes resilience. MiniDuke has used Twitter as an initial or primary mechanism for obtaining command-and-control information, with Google Search used as a fallback when that channel is unavailable. Some components can use a domain generation algorithm to derive new Twitter URLs for command-and-control discovery. Certain samples also support multiple exfiltration paths, including HTTP PUT, HTTP POST with data concealed inside a fake image structure, and named-pipe-based forwarding when direct Internet access is unavailable. Reporting also notes the ability to relay communications through a named pipe from one compromised host with Internet access to other compromised machines, supporting segmented-network operations.
MiniDuke is part of the broader Duke malware ecosystem, alongside families such as CozyDuke, CosmicDuke, OnionDuke, SeaDuke, RegDuke, PolyglotDuke, and FatDuke. In some campaigns it was deployed in parallel with other Duke implants to provide persistence redundancy and multiple exploitation paths. CosmicDuke has been described as combining MiniDuke-style backdoor functionality with information-stealing capabilities, underscoring MiniDuke’s role as a foundational espionage implant within the Dukes toolchain.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In parallel, the Duke group was also installing separate malware onto these networks, namely Backdoor.Miniduke and the more elusive Trojan.Seaduke.
In parallel, the Duke group was also installing separate malware onto these networks, namely Backdoor.Miniduke and the more elusive Trojan.Seaduke.
In parallel, the Duke group was also installing separate malware onto these networks, namely Backdoor.Miniduke and the more elusive Trojan.Seaduke.
In February 2014 we observed the Miniduke threat actor using the same backdoor on their hacked servers, although using a much stronger password.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Table 1: Implemented commands ... exew execute command ... exec execute command interactively ... exeu execute command interactively as specified domain user
Command 'exeu' - process creation in a domain environment ... CreateProcessWithLogonW( &Username, &Domain, lpPassword ... )
Byte = 0x33 – create a new process in the security context of the credentials received from the C2 server
Command 'exeu' - process creation in a domain environment ... CreateProcessWithLogonW( &Username, &Domain, lpPassword ... )
the backdoor has added a lot of obfuscation that consists of control-flow flattening (every function is split in a switch/case, and a lot of computation that is useless for the main execution flow is added)
The encrypted buffer is added to a fake JPEG image (note the file signature in the network traffic) and transmitted to the C2 server without raising any suspicion
Byte = 0x33 – create a new process in the security context of the credentials received from the C2 server
the backdoor also performs a “cleaning” operation by freeing the memory in order to hide possible IOCs that could be extracted from it
Command 'exeu' - process creation in a domain environment ... CreateProcessWithLogonW( &Username, &Domain, lpPassword ... )
The malware retrieves the NetBIOS name of the local computer and the user name by calling the GetComputerNameA and GetUserNameA functions
Discovery T1057 Process Discovery The Dukes can list running processes.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
The modified SHA1 algorithm in the MiniDuke sample is used to create a per-system encryption key for the malware configuration.
APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.
Command and Control T1071 Standard Application Layer Protocol The Dukes are using HTTP and HTTPS protocols to communicate with the C&C server.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
APT41 used the Steam community page as a fallback mechanism for C2. Crutch has used a hardcoded GitHub repository as a fallback channel. MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A staged toolset comprising downloader, backdoor, and loader components.
MiniDuke is a backdoor malware used by the APT29/Cozy Bear threat actor for cyber espionage operations.
MiniDuke is a backdoor malware used by the APT29/Cozy Bear threat actor for cyber espionage operations.
Referenced as a constituent or predecessor malware family combined into CosmicDuke.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.