CozyDuke CozyDuke

  • First known sample

    2014

  • Discovery

    2015

  • Number of targets

    1-100

  • Current status

    Active

  • Type

    Backdoor , Dropper

  • Targeted platforms

    Windows

  • TOP targeted countries

    Germany , South Korea , USA , Ukraine , Uzbekistan

  • Connected attacks

    CosmicDuke , MiniDuke

  • The way of propagation

    Social engineering , Watering hole attacks

  • Purpose/Functions

    Cyberespionage
  • Special features
    extremely sensitive high profile victims and targets (targets in the U.S. are believed to include the White House and the State Department)

  • Targets

    Government entities , Commercial entities
  • Artefacts/Attribution
    Strong malicious program functionality, as well as structural similarities match thу CozyDuke toolset with the MiniDuke, CosmicDuke and OnionDuke cyberespionage campaigns; operations that, according to a number of indicators, are believed to be managed by Russian-speaking authors.
  • Description

    An APT carrying out cyberespionage campaigns against government organizations and commercial entities in the US, Germany, and South Korea. In 2014, targets included the White House and the US Department of State. Initial infection often occurs by spear-phishing targets with e-mails containing a link to a hacked website or phony flash videos.

    Additional information

© 2024 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com