H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[CosmicDuke](https://attack.mitre.org/software/S0050) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2010 to 2015. (Citation: F-Secure The Dukes)

Labels

malware

20 recorded

Relationships

uses

from APT29

Group

uses

to Automated Exfiltration

Technique

uses

to Clipboard Data

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Data from Local System

Technique

uses

to Data from Network Shared Drive

Technique

uses

to Data from Removable Media

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to File and Directory Discovery

Technique

uses

to Keylogging

Technique

uses

to Local Email Collection

Technique

uses

to LSA Secrets

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Security Account Manager

Technique

uses

to Symmetric Cryptography

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

S0050

open

F-Secure The Dukes

https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf

open