LiteDuke

LiteDuke is a third stage backdoor that was used by APT29, primarily in 2014-2015. LiteDuke used the same dropper as PolyglotDuke, and was found on machines also compromised by MiniDuke.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

14 relationships

T1033: System Owner/User Discovery

source

T1082: System Information Discovery

source

T1140: Deobfuscate/Decode Files or Information

source

T1497.003: Time Based Checks

source

T1016: System Network Configuration Discovery

source

T1547.001: Registry Run Keys / Startup Folder

source

T1027.003: Steganography

source

T1012: Query Registry

source

T1518.001: Security Software Discovery

source

T1070.004: File Deletion

source

T1027.002: Software Packing

source

T1071.001: Web Protocols

source

T1105: Ingress Tool Transfer

source