H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[PolyglotDuke](https://attack.mitre.org/software/S0518) is a downloader that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2013. [PolyglotDuke](https://attack.mitre.org/software/S0518) has been used to drop [MiniDuke](https://attack.mitre.org/software/S0051).(Citation: ESET Dukes October 2019)

Labels

malware

12 recorded

Relationships

uses

from APT29

Group

uses

from Operation Ghost

Campaign

uses

to Dead Drop Resolver

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Fileless Storage

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Steganography

Technique

uses

to Web Protocols

Technique

2 external

References

mitre-attack

S0518

ESET Dukes October 2019

https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf