{
  "family": "miniduke",
  "sample_count": 22,
  "category": "trojan",
  "description": "MiniDuke (classified across threat intelligence repositories under designations including Backdoor:Win32/MiniDuke, Trojan:Win32/MiniDuke, and Win32/MiniDuke) is a highly sophisticated cyber espionage backdoor framework attributed to the Russian nation-state threat group APT29 (also known as Cozy Bear or Nobelium). First identified in early 2013 targeting government institutions, military agencies, and foreign ministries across Europe and North America, MiniDuke was deployed via spearphishing emails containing weaponized PDF documents exploiting Adobe Acrobat vulnerabilities (such as CVE-2013-0604). The initial stager consists of a remarkably tiny, heavily obfuscated assembly loader that verifies host architecture, decodes hidden C2 server handles from public Twitter/X accounts or Google Search results, and downloads a secondary modular backdoor. MiniDuke executes encrypted remote shell commands, harvests confidential intelligence, and maintains deeply stealthy persistence.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/MiniDuke",
    "Trojan:Win32/MiniDuke",
    "Win32/MiniDuke",
    "APT29 MiniDuke",
    "CozyBear MiniDuke"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/MiniDuke?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MiniDuke is a sophisticated espionage backdoor framework attributed to APT29 (Cozy Bear), targeting government and defense entities."
      }
    },
    {
      "@type": "Question",
      "name": "Which threat actor group operates MiniDuke?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is operated by Russian state-sponsored threat group APT29 (also tracked as Cozy Bear, Nobelium, and Midnight Blizzard)."
      }
    },
    {
      "@type": "Question",
      "name": "How was MiniDuke distributed to high-profile targets?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed via spearphishing emails containing weaponized PDF files that exploited Adobe Reader vulnerabilities like CVE-2013-0604."
      }
    },
    {
      "@type": "Question",
      "name": "How does MiniDuke identify command-and-control servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It used dead drop resolvers, parsing encrypted C2 handles from specific Twitter accounts and Google Search queries."
      }
    },
    {
      "@type": "Question",
      "name": "What incident response measures are required for MiniDuke intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the compromised network environment, conduct full memory triage, audit privilege escalation events, and perform domain-wide credential revocation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1203",
    "T1102",
    "T1059.003",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Kaspersky Lab - The MiniDuke Mystery: Targeted Cyber Espionage Report",
      "url": "https://securelist.com/the-miniduke-mystery-pdf-0-day-government-spy-assembler-0x29a/58351/"
    },
    {
      "name": "Microsoft Threat Intelligence - APT29 Threat Profile",
      "url": "https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/"
    },
    {
      "name": "CISA / FBI Joint Cybersecurity Advisory - Russian SVR Cyber Activity",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1203",
      "name": "Exploitation for Client Execution",
      "tactic": "Execution"
    },
    {
      "id": "T1102",
      "name": "Web Service: Dead Drop Resolver",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints and sensitive enclaves immediately from all external networks.",
    "Perform live memory acquisitions across suspected machines to capture volatile decryption routines.",
    "Audit perimeter web proxies for encrypted outbound requests resolving through social media or dead drop URLs.",
    "Patch Adobe Acrobat and client-side applications against historical and modern memory corruption exploits.",
    "Execute complete domain credential rotation across all administrative, service, and user accounts."
  ],
  "what_to_avoid": [
    "Do not perform standard reboots or simple file deletions on high-value targets, as nation-state implants may have secondary dormant backdoors.",
    "Do not treat the intrusion as opportunistic cybercrime; escalate immediately to specialized nation-state threat response teams."
  ],
  "target_industries": [
    "Government Ministries",
    "Defense & Military",
    "Foreign Affairs & Diplomacy",
    "Research Institutions"
  ],
  "target_geographies": [
    "Europe",
    "North America",
    "NATO Member States"
  ],
  "threat_actors": [
    "APT29 (Cozy Bear / Nobelium / Midnight Blizzard / Russian SVR)"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "command_and_control",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Geopolitical Espionage & Intelligence Gathering",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}