Loading story…
Kaspersky reported that the CozyDuke advanced persistent threat conducted targeted intrusions using spearphishing emails and malware-laced documents to compromise victims that included government organizations, diplomatic entities, and other high-profile institutions. The campaign relied on social engineering themes tied to political and security events, with malicious attachments and links delivering backdoors designed to establish persistence, collect system information, and enable follow-on access.
The operation was described as part of a broader espionage effort linked to tools and tactics overlapping with other Duke malware families, indicating a coordinated threat actor with a mature toolkit. Researchers said the malware used stealth and modular functionality to evade detection and maintain long-term access, underscoring the risk posed by state-aligned intrusion sets that blend tailored phishing, custom implants, and quiet data collection against strategic targets.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report titled "The CozyDuke APT," documenting the threat actor and its activity. No additional event details are available from the provided reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT29, also known as **Cozy Bear** or **The Dukes**, has continued a long-running cyberespionage campaign against government and diplomatic targets in Europe and the United States, using successive Duke-family malware strains including **MiniDuke**, **CozyDuke**, **Seaduke**, **OnionDuke**, **PolyglotDuke**, **RegDuke**, **FatDuke**, and **CosmicDuke**. Reporting links the activity to Russian **SVR** interests and shows the group repeatedly focusing on ministries of foreign affairs, embassies, policy organizations, and other high-value institutions, with operations stretching from earlier intrusions against select government victims to later compromises of European foreign ministries and an EU-country embassy in Washington, DC.
Aug 15, 2026
Positive Technologies reported that **PhantomCore** conducted a large-scale cyberespionage campaign using a mix of phishing, compromised corporate email accounts, malicious attachments and links, and in some cases exploitation of a TrueConf vulnerability chain tracked as `BDU:2025-10114`, `BDU:2025-10115`, and `BDU:2025-10116`. The group was observed deploying a substantial custom toolset including **PhantomRAT**, **PhantomRShell**, **PhantomTaskShell**, **PhantomProxyLite**, **PhantomStealer**, and a dedicated control panel, while also abusing legitimate software such as MeshAgent, OpenSSH, Rclone, and XenArmor. Researchers said the activity may indicate a split within the PhantomCore APT group. After gaining access, the attackers established persistence with disguised scheduled tasks, services, local accounts, and web shells, then stole credentials from **LSASS** and **NTDS**, moved laterally over **RDP**, **SMB**, and **WinRM**, and masked operations with obfuscated PowerShell, DLL hijacking, disabled defenses, and cleared logs. Their command-and-control infrastructure used phishing domains, VPS hosts, compromised servers, SSH and SOCKS5 tunnels, HTTPS, and nonstandard ports, with data exfiltration carried out through HTTP channels, external servers, and cloud storage including **Mega.nz**. In at least one intrusion, the operation escalated from espionage to destructive impact when PhantomCore used Kaspersky Security Center to distribute **LockBit 3.0** ransomware across compromised systems.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026