SYMBOLCOMMON_NAMEaka. SYNONYMS

ItaDuke  (Back to overview)

aka: DarkUniverse, SIG27

ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by Kaspersky.

Associated Families

There are currently no families associated with this actor.

References
2019-11-05 ⋅ Kaspersky Labs ⋅ Andrey Dolgushev, Vasily Berdnikov, Alexander Fedotov
@online{dolgushev:20191105:darkuniverse:36ead28, author = {Andrey Dolgushev and Vasily Berdnikov and Alexander Fedotov}, title = {{DarkUniverse – the mysterious APT framework #27}}, date = {2019-11-05}, organization = {Kaspersky Labs}, url = {https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/}, language = {English}, urldate = {2020-04-24} } DarkUniverse – the mysterious APT framework #27
ItaDuke
2013-03-14 ⋅ Kaspersky Labs ⋅ Igor Kuznetsov, Costin Raiu
@online{kuznetsov:20130314:new:148c189, author = {Igor Kuznetsov and Costin Raiu}, title = {{New Uyghur and Tibetan Themed Attacks Using PDF Exploits}}, date = {2013-03-14}, organization = {Kaspersky Labs}, url = {https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465}, language = {English}, urldate = {2020-04-24} } New Uyghur and Tibetan Themed Attacks Using PDF Exploits
ItaDuke
2013-02-13 ⋅ FireEye ⋅ James T. Bennett
@online{bennett:20130213:number:c947ab9, author = {James T. Bennett}, title = {{The Number of the Beast}}, date = {2013-02-13}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html}, language = {English}, urldate = {2020-04-24} } The Number of the Beast
ItaDuke
Credits: MISP Project