{
  "family": "cosmicduke",
  "sample_count": 408,
  "category": "infostealer",
  "description": "Backdoor:Win32/CosmicDuke is a highly sophisticated, state-sponsored espionage backdoor attributed to APT29 (Cozy Bear / Russian SVR), designed for long-term intelligence gathering and data exfiltration.<br><br><b>Understanding CosmicDuke</b><br>To the victim organization, CosmicDuke operates with absolute stealth. For threat intelligence analysts, CosmicDuke represents top-tier nation-state tradecraft. It is a variant of the infamous MiniDuke family, heavily customized to steal highly sensitive documents, cryptographic keys, and user credentials from government, diplomatic, and defense sector targets.<br><br><b>Execution and Evasion Strategies</b><br>CosmicDuke is deployed via highly targeted spearphishing campaigns containing weaponized PDF or Microsoft Word documents exploiting zero-day or N-day vulnerabilities. Upon execution, the payload utilizes advanced anti-analysis techniques, checking for virtualization, debuggers, and specific EDR hooks. It establishes persistence via WMI event subscriptions or hidden scheduled tasks. CosmicDuke heavily encrypts its C2 communications and frequently utilizes steganography (hiding data within image files) or compromised legitimate websites to exfiltrate stolen intelligence without triggering network alarms.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a catastrophic breach of national security or corporate espionage. Incident responders tracking APT29 should hunt for anomalous, low-and-slow network traffic to compromised, previously legitimate infrastructure. Memory forensics is absolutely critical to extract the heavily obfuscated CosmicDuke payload and its configuration. The presence of unauthorized WMI subscriptions or anomalous child processes spawning from heavily used applications (like browsers or Office) are key IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1002",
    "T1566.001",
    "T1573",
    "T1055",
    "T1546.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1573",
      "name": "Encrypted Channel",
      "tactic": "Command and Control"
    },
    {
      "id": "T1002",
      "name": "Data Compressed",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1546.003",
      "name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint and assume a full-scale network breach; APT29 utilizes CosmicDuke as a beachhead for lateral movement.",
    "Engage a specialized Incident Response (IR) firm with experience in nation-state threat actors.",
    "Perform live memory forensics to extract the decrypted payload, C2 configurations, and any staged data awaiting exfiltration.",
    "Force a global password reset and heavily monitor Active Directory for signs of Kerberoasting or Golden Ticket attacks."
  ],
  "what_to_avoid": [
    "Do not attempt to 'clean' the machine; nation-state actors deploy deeply embedded rootkits. The machine must be physically destroyed or forensically wiped.",
    "Avoid tipping off the attacker; if APT29 detects IR activity, they will often destroy the infrastructure or deploy wipers to cover their tracks."
  ],
  "target_industries": [
    "Financial Services",
    "Retail",
    "Consumers"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}