MITRE ATT&CKsoftware (malware)
S0513 LiteDuke
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2020-09-24
Description
LiteDuke is a third stage backdoor that was used by APT29, primarily in 2014-2015. LiteDuke used the same dropper as PolyglotDuke, and was found on machines also compromised by MiniDuke.
Related
Uses · MITRE ATT&CK (13)
- T1071.001 Web Protocols sub-technique
- T1497.003 Time Based Checks sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1027.002 Software Packing sub-technique
- T1027.003 Steganography sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1012 Query Registry technique
- T1016 System Network Configuration Discovery technique
- T1033 System Owner/User Discovery technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G0016 APT29 group
References
- https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf ESET Dukes October 2019