H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[RegDuke](https://attack.mitre.org/software/S0511) is a first stage implant written in .NET and used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2017. [RegDuke](https://attack.mitre.org/software/S0511) has been used to control a compromised machine when control of other implants on the machine was lost.(Citation: ESET Dukes October 2019)

Labels

malware

11 recorded

Relationships

uses

from APT29

Group

uses

from Operation Ghost

Campaign

uses

to Bidirectional Communication

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Fileless Storage

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Modify Registry

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Steganography

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

2 external

References

mitre-attack

S0511

ESET Dukes October 2019

https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf