#dukemalware

The PinchDuke campaign, which operated from November 2008 until summer 2010, is believed to be the first campaign of the Duke malware family. PinchDuke targeted political organizations in Georgia, Turkey, Uganda, and the United States. The PinchDuke campaigns began 11 days after President Obama’s April 5, 2008 speech concerning the deployment of missile defenses in Poland. In 2009 the campaign targeted the Ministry of Defense in Georgia, the ministries of foreign affairs in Turkey and Uganda, a United States foreign policy think tank, organizations associated with NATO exercises in Europe, and the Georgian Information Centre on NATO. In 2010, the group also targeted Kazakhstan, Kyrgyzstan, Azerbaijan, and Uzbekistan. The political nature of the targets suggests that the campaigns may have been state sponsored. The selection of targets closely mirrors those of the later APT28/ Sofacy campaigns, which is widely believed a Russian state sponsored threat actor.

The PinchDuke campaign, which operated from November 2008 until summer 2010, is believed to be the first campaign of the Duke malware family. PinchDuke targeted political organizations in Georgia, Turkey, Uganda, and the United States. The PinchDuke campaigns began 11 days after President Obama’s April 5, 2008 speech concerning the deployment of missile defenses in Poland. In 2009 the PinchDuke campaign targeted the Ministry of Defense in Georgia, the ministries of foreign affairs in Turkey and Uganda, a United States foreign policy think tank, organizations associated with NATO exercises in Europe, and the Georgian Information Centre on NATO. In 2010, the group also targeted Kazakhstan, Kyrgyzstan, Azerbaijan, and Uzbekistan. The political nature of the targets suggests that the campaigns may have been state sponsored. The selection of targets closely mirrors those of the later APT28/ Sofacy campaigns, which is widely believed a Russian state sponsored threat actor. Like the rest of the Duke family of malware, the threat actor is attributed to Russia because error messages in the malware are written in Russian. Though many regions in Eastern Europe use Russian as their primary language, time stamps in the code suggest that the malware was developed in the same time zone as Moscow. The PinchDuke Trojan samples contain a text string that may serve as a campaign identifier to help the attackers differentiate between associated Duke malware campaigns that were run in parallel using similar exploitation kits.

dukemalware

The PinchDuke campaign, which operated from November 2008 until summer 2010, is believed to be the first campaign of the Duke malware family. PinchDuke targeted political organizations in Georgia, Turkey, Uganda, and the United States. The pinchduke campaigns began 11 days after President Obama’s April 5, 2008 speech concerning the deployment of missile defenses in Poland. In 2009 the PinchDuke campaign targeted the Ministry of Defense in Georgia, the ministries of foreign affairs in Turkey and Uganda, a United States foreign policy think tank, organizations associated with NATO exercises in Europe, and the Georgian Information Centre on NATO. In 2010, the group also targeted Kazakhstan, Kyrgyzstan, Azerbaijan, and Uzbekistan. The political nature of the targets suggests that the campaigns may have been state sponsored. The selection of targets closely mirrors those of the later APT28/ Sofacy campaigns, which is widely believed a Russian state sponsored threat actor. Like the rest of the Duke family of malware, the threat actor is attributed to Russia because error messages in the malware are written in Russian. Though many regions in Eastern Europe use Russian as their primary language, time stamps in the code suggest that the malware was developed in the same time zone as Moscow. The PinchDuke Trojan samples contain a text string that may serve as a campaign identifier to help the attackers differentiate between associated Duke malware campaigns that were run in parallel using similar exploitation kits.