MalwareUsed by 1 actor

Duke

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT29

One of the PDFs delivered a variant of Duke - a malware that has been linked to Russian state-sponsored cyber espionage activities of APT29.

via eclecticiq blogblog.eclecticiq.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1584.006Web ServicesEvidence1

The actor used the API features of Zulip to send victim details to an actor-controlled chat room (toyy[.]zulipchat[.]com), and to issue malicious remote commands.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

MITRE ATT&CK Techniques Spearphishing Attachment - T1566.001

Execution

1 technique

T1204.002Malicious FileEvidence1

Upon user execution the PDF document displays an “Open File” alert box... If a victim opens it, the code will launch the malicious HTML file called Invitation_Farewell_DE_EMB.

Stealth

4 techniques

T1027.006HTML SmugglingEvidence1

Invitation_Farewell_DE_EMB is an HTML file. Through HTML smuggling, the threat actor delivered a ZIP file that contained a malicious HTML Application (HTA).

T1027.007Dynamic API ResolutionEvidence1

Analysis showed that the malware used Windows API hashing to hide the names of the Windows API function calls.

T1027.009Embedded PayloadsEvidence1

The first PDF contained embedded JavaScript code to deliver multi-staged payloads in HTML file format.

T1218.005MshtaEvidence1

An HTA file is a widely used Living Off The Land Binary (LOLBIN) containing both HTML and scripting code to create a standalone malicious application that is executed by the Windows HTA engine mshta.exe.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

EclecticIQ analysts observed that threat actor used Zulip servers to establish a C2 connection, and to blend with legitimate web traffic.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eclecticiq blogNews

Jan 1, 2024

German Embassy Lure: Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs

A Duke malware variant delivered via PDF-to-HTML smuggling and HTA stages, then executed through DLL sideloading into msoev.exe. It uses Windows API hashing and XOR-encrypted strings for evasion, opens a decoy PDF lure, and communicates with actor-controlled Zulip infrastructure for command-and-control.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Duke

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT29

One of the PDFs delivered a variant of Duke - a malware that has been linked to Russian state-sponsored cyber espionage activities of APT29.

via eclecticiq blogblog.eclecticiq.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1584.006Web ServicesEvidence1

The actor used the API features of Zulip to send victim details to an actor-controlled chat room (toyy[.]zulipchat[.]com), and to issue malicious remote commands.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

MITRE ATT&CK Techniques Spearphishing Attachment - T1566.001

Execution

1 technique

T1204.002Malicious FileEvidence1

Upon user execution the PDF document displays an “Open File” alert box... If a victim opens it, the code will launch the malicious HTML file called Invitation_Farewell_DE_EMB.

Stealth

4 techniques

T1027.006HTML SmugglingEvidence1

Invitation_Farewell_DE_EMB is an HTML file. Through HTML smuggling, the threat actor delivered a ZIP file that contained a malicious HTML Application (HTA).

T1027.007Dynamic API ResolutionEvidence1

Analysis showed that the malware used Windows API hashing to hide the names of the Windows API function calls.

T1027.009Embedded PayloadsEvidence1

The first PDF contained embedded JavaScript code to deliver multi-staged payloads in HTML file format.

T1218.005MshtaEvidence1

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

EclecticIQ analysts observed that threat actor used Zulip servers to establish a C2 connection, and to blend with legitimate web traffic.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eclecticiq blogNews

Jan 1, 2024

German Embassy Lure: Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.