Loading threat actor…
MiniDuke is a cyber-espionage threat actor and associated malware operation linked in multiple reporting streams to the broader Turla ecosystem. The actor is known for stealthy, targeted intrusions against high-value organizations and for tradecraft centered on covert command-and-control, staged compromise, and long-term intelligence collection. Reporting has noted operational links between MiniDuke and Turla, including overlap in infrastructure usage patterns and similarities in tooling and techniques, though public attribution should be treated as linkage rather than definitive organizational identity where not explicitly established. MiniDuke is notable for using concealed command-and-control discovery methods, including hiding encrypted or encoded control-server information in comments on legitimate websites. This technique has been cited as distinctive tradecraft later echoed by other espionage actors. Malware associated with MiniDuke has also been noted for use of less-common implementation choices such as the LZJB compression algorithm. Available reporting in the supplied material does not provide a full standalone victimology profile for MiniDuke itself, but the actor is consistently referenced in the context of advanced espionage activity rather than financially motivated crime or disruptive operations. The strongest supported characterization is that MiniDuke is an espionage-oriented actor associated with covert persistence, post-compromise control, and data collection, with reported ties to the Turla cluster.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a known actor using similar C2-hiding tradecraft (embedding encrypted/base64 C2 data in comments on legitimate sites).
Mentioned as a separate threat actor observed using the same (webshell/backdoor) tooling on compromised servers, suggesting possible operational/tooling overlap with Turla.
Mentioned as a separate threat actor observed using the same (webshell/backdoor) tooling on compromised servers, suggesting possible operational/tooling overlap with Turla.
Referenced only as a point of comparison for rare compression algorithm usage; no direct activity details in this content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.