CosmicDuke

Executive Summary

CosmicDuke is a Windows RAT used by APT29 (The Dukes) from 2010‑15 to conduct espionage via remote command and control. It delivers backdoor capabilities and exfiltrates sensitive data over HTTP/HTTPS, making it a persistent threat for targeted organizations.

CosmicDuke is a Windows‐based remote access trojan that operated as part of the APT29 threat actor’s toolset from 2010 to 2015, according to F‑Secure reports on The Dukes. The malware functions as a typical espionage RAT: it establishes command and control connectivity over HTTP/HTTPS, downloads additional payloads, collects system information, and exfiltrates data from compromised hosts. Common capabilities include file system reconnaissance, credential harvesting and keylogging, making it suitable for long‑term intelligence gathering. CosmicDuke’s code base is modular; once installed it spawns a background service that persists across reboots and can communicate with multiple command servers. It is often referenced under the aliases TinyBaron, BotgenStudios, and NemesisGemina, reflecting its use in various espionage campaigns. Overall, CosmicDuke demonstrates classic APT29 techniques: stealthy persistence, outbound communication over standard web protocols, and payload delivery for lateral movement or data theft.

Key Capabilities

• Persistence via service installation
• HTTP/HTTPS C2 communication
• Payload download and execution
• System information gathering
• Credential harvesting & keylogging
• Data exfiltration

ATT&CK Techniques

Recommended Actions

• Maintain an up‑to‑date inventory of installed binaries and monitor for new services named after known CosmicDuke modules.
• Block outbound connections to known malicious domain/IP prefixes associated with The Dukes’ C2 infrastructure.
• Deploy host‑based IDS/IPS rules that flag suspicious PowerShell or cmd.exe execution used by the RAT.
• Enable Windows event logging for file creation, registry modification, and process launch events, and correlate these with threat indicators (e.g., cosmicduke.md5 hash).
• Apply security hardening such as disabling autostart of unfamiliar background services and enforcing least‑privilege user accounts.

Suggested Tags