Cybercrime
ItaDuke
Also known as DarkUniverse, SIG27
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by Kaspersky.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/
- https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html
- https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.