MalwareUsed by 1 actor

PinchDuke

PinchDuke is an information-stealing malware family associated with APT29, also known as The Dukes, a Russian cyberespionage threat actor. It is described as a toolset comprising several loaders and a core credential-stealing trojan used on compromised Windows systems. PinchDuke is designed to harvest credentials from infected hosts, including browser-stored and application-stored secrets, and its credential theft functionality has been linked to code derived from the Pinch, or LdPinch, credential stealer. Reported targets for credential collection include the WinInet credential cache, LDAP-associated credentials, and credentials tied to applications and services such as Microsoft Outlook, The Bat!, Yahoo!, Mail.ru, Passport.Net, and Google Talk. Beyond credential theft, PinchDuke can gather system configuration information, search for files created within specified timeframes, collect user files matching predefined extension lists, and transfer stolen data from the victim over HTTP or HTTPS to command-and-control infrastructure. The malware has been used as part of broader Dukes espionage operations focused on intelligence collection.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT29

The group’s malware and campaigns include PinchDuke, GeminiDuke, CosmicDuke, MiniDuke, CozyDuke, OnionDuke, SeaDuke, HammerDuke and CloudDuke.

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

APT29 has been observed crafting targeted spearphishing campaigns leveraging web links to a malicious dropper; once executed, the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques.

Credential Access

4 techniques

T1003OS Credential DumpingEvidence2

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims... BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems... Storm-0501 has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.

T1555Credentials from Password StoresEvidence6

Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData

T1555.003Credentials from Web BrowsersEvidence6

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

T1555.005Password ManagersEvidence1

Evilnum can collect email credentials from victims... Malteiro has obtained credentials from mail clients via NirSoft MailPassView... MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software... PLEAD has the ability to steal saved passwords from Microsoft Outlook.

Discovery

2 techniques

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

T1083File and Directory DiscoveryEvidence6

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Collection

1 technique

T1005Data from Local SystemEvidence4

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The content states 'APT29 has used HTTP for C2 and data exfiltration,' 'FIN4 has used HTTP POST requests to transmit data,' 'Pony has sent collected information to the C2 via HTTP POST request,' and 'ThiefQuest uploads files via unencrypted HTTP.'

ACTIVITY FEED

Recent activity

22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

22 SOURCESView more in app

cyble blogNews

Feb 20, 2025

Threat Actor Profile: APT29 - Cyble

A toolset with multiple loaders and a core information-stealing trojan, with overlap observed with CosmicDuke loaders.

vulncheck blogNews

Feb 15, 2024

Reimagining How We Think About Threat Actors

PinchDuke is a backdoor malware used by APT29/Cozy Bear for espionage and data exfiltration.

vulncheck blogNews

Feb 15, 2024

Reimagining How We Think About Threat Actors

PinchDuke is a backdoor malware used by APT29/Cozy Bear for espionage and data exfiltration.

mitre attack websiteNews

Oct 21, 2021

Credentials from Password Stores: Credentials from Web Browsers, Sub-technique T1555.003 - Enterprise | MITRE ATT&CK®

Credential-stealing malware targeting credentials from browsers and other applications.

+18 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PinchDuke