- Category
- State · Attributed to a state or working for one.
- Origin
- China(medium confidence)
- Motivation
- Information theft and espionage
- Seen
- 2017–2019
- Status
- Dormant
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0129 · itaduke
ChinaWhat it is
ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by Kaspersky.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- NSA leak
- SIG27
- Other names
- DarkUniverse
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Afghanistan, Belarus, Ethiopia, Iran, Russia, Sudan, Syria, Tanzania, United Arab Emirates
- Sectors
- Defense
Tools
The tools and malware families the sources tie to it.
- ItaDuke
- Xploit
- dfrgntfs5.sqt
- glue30.dll
- msvcrt58.sqt
- updater.mod
- zl4vq.sqt
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de