S0511 RegDuke

malwareEnterprise

platformsWindows

also known asRegDuke

RegDuke is a first stage implant written in.NET and used by APT29 since at least 2017. RegDuke has been used to control a compromised machine when control of other implants on the machine was lost.

techniques used (9)

ATT&CK techniques this enables or maps to.

T1027Obfuscated Files or Information
T1027.003Steganography
T1027.011Fileless Storage
T1059.001PowerShell
T1102.002Bidirectional Communication
T1105Ingress Tool Transfer
T1112Modify Registry
T1140Deobfuscate/Decode Files or Information
T1546.003Windows Management Instrumentation Event Subscription

used by groups (1)

Threat groups associated with this.

G0016APT29

used by campaigns (1)

Campaigns that use this.

C0023Operation Ghost

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan