Loading story…
Researchers reported that the MiniDuke cyber-espionage operation had re-emerged with updated malware and supporting infrastructure, including components dubbed Nemesis Gemina and the Botgen Studio framework. The activity was linked to targeted intrusions associated with long-running espionage tradecraft, indicating that the operators had rebuilt or expanded their toolset after earlier exposure.
The renewed campaign showed a shift from the original MiniDuke implants toward a broader platform designed to manage compromised systems and support stealthy persistence and command-and-control. The findings suggested a mature threat actor continuing to refine its malware ecosystem for selective, intelligence-focused operations against chosen victims.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published research describing the return of MiniDuke activity and connecting it to the Nemesis Gemina and Botgen Studio malware frameworks. The article indicates a new technical disclosure and attribution development in the MiniDuke story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the **CozyDuke** advanced persistent threat conducted targeted intrusions using spearphishing emails and malware-laced documents to compromise victims that included government organizations, diplomatic entities, and other high-profile institutions. The campaign relied on social engineering themes tied to political and security events, with malicious attachments and links delivering backdoors designed to establish persistence, collect system information, and enable follow-on access. The operation was described as part of a broader espionage effort linked to tools and tactics overlapping with other Duke malware families, indicating a coordinated threat actor with a mature toolkit. Researchers said the malware used stealth and modular functionality to evade detection and maintain long-term access, underscoring the risk posed by state-aligned intrusion sets that blend tailored phishing, custom implants, and quiet data collection against strategic targets.
Jul 12, 2026
APT29, also known as **Cozy Bear** or **The Dukes**, has continued a long-running cyberespionage campaign against government and diplomatic targets in Europe and the United States, using successive Duke-family malware strains including **MiniDuke**, **CozyDuke**, **Seaduke**, **OnionDuke**, **PolyglotDuke**, **RegDuke**, **FatDuke**, and **CosmicDuke**. Reporting links the activity to Russian **SVR** interests and shows the group repeatedly focusing on ministries of foreign affairs, embassies, policy organizations, and other high-value institutions, with operations stretching from earlier intrusions against select government victims to later compromises of European foreign ministries and an EU-country embassy in Washington, DC.
Aug 15, 2026
Trend Micro reported that the **ChessMaster** threat actor updated its intrusion toolkit, adding new malware components and refining the tools used to compromise targets. The activity was linked to cyberespionage operations, with the group maintaining persistence through refreshed backdoors and related utilities designed to support long-term access and data collection inside victim environments. The report indicates the operators continued to evolve their arsenal rather than relying on older implants alone, suggesting an effort to improve stealth, resilience, and operational reach. For defenders, the development highlighted the need to track changes in attacker tooling as closely as known indicators, because incremental malware updates can allow established espionage groups to bypass existing detections and sustain campaigns against selected organizations.
Jul 12, 2026