ItaDuke

Also reported as DarkUniverse and SIG27.

Reports: 12
Last reported: 4 December 2019
Known CVEs: 10

ID: itaduke
Sources: MISP ETDA Malpedia
Merge evidence: 4 alias matches

Reports per quarter

2013 Q1: 3 reports
2013 Q2: no reports
2013 Q3: no reports
2013 Q4: no reports
2014 Q1: no reports
2014 Q2: no reports
2014 Q3: no reports
2014 Q4: 1 report
2015 Q1: no reports
2015 Q2: no reports
2015 Q3: 3 reports
2015 Q4: no reports
2016 Q1: no reports
2016 Q2: no reports
2016 Q3: no reports
2016 Q4: no reports
2017 Q1: no reports
2017 Q2: no reports
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: 1 report
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: 4 reports

Dated reports, 2013 Q1 to 2019 Q4.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

4 December 2019

APT review: what the world’s threat actors got up to in 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT review: what the world’s threat actors got up to in 2019
5 November 2019

DarkUniverse - the mysterious APT framework 27

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The link to Mirror on Box failed its last check. Mirror on Box Detailsfor DarkUniverse - the mysterious APT framework 27
5 November 2019

DarkUniverse - the mysterious APT framework #27

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DarkUniverse - the mysterious APT framework #27
16 October 2019

APT trends report Q3 2019

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor APT trends report Q3 2019
1 March 2018

ukatemicrysys_territorialdispute

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ukatemicrysys_territorialdispute
15 September 2015

The Dukes: 7 years of Russian cyberespionage

file creation date F-Secure fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The Dukes: 7 years of Russian cyberespionage
1 September 2015

F-Secure_Dukes_Whitepaper.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor F-Secure_Dukes_Whitepaper.pdf
17 August 2015

dukes_whitepaper.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor dukes_whitepaper.pdf
10 December 2014

Cloud Atlas: RedOctober APT is back in style

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cloud Atlas: RedOctober APT is back in style
14 March 2013

New Uyghur and Tibetan Themed Attacks Using PDF Exploits

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Uyghur and Tibetan Themed Attacks Using PDF Exploits

Show all 12 reports Show fewer

14 March 2013

New Uyghur and Tibetan Themed Attacks Using PDF Exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Uyghur and Tibetan Themed Attacks Using PDF Exploits
27 February 2013

Kaspersky Word template

file creation date Kaspersky fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Kaspersky Word template

Newest first. Details opens the report in Explore.