CozyDuke

Атакуемые страны

• Австралия
• Азербайджан
• Беларусь
• Бельгия
• Болгария
• Бразилия
• Великобритания
• Венгрия
• Германия
• Грузия
• Израиль
• Индия
• Ирландия
• Испания
• Казахстан
• Канада
• Кипр
• Китай
• Кыргызстан
• Латвия
• Ливан
• Литва
• Люксембург
• Мексика
• Нидерланды
• Новая Зеландия
• Польша
• Португалия
• Россия
• Румыния
• Словения
• Соединенные Штаты Америки
• Турция
• Уганда
• Узбекистан
• Украина
• Франция
• Черногория
• Чехия
• Южная Корея
• Япония

Отчеты Positive Technologies и других исследователей

• https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf
• https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
• https://www.carbonblack.com/blog/the-dukes-of-moscow/
• https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
• https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf
• https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf
• https://securelist.com/the-cozyduke-apt/69731/
• https://securelist.com/miniduke-is-back-nemesis-gemina-and-the-botgen-studio/64107/
• https://securelist.com/the-miniduke-mystery-pdf-0-day-government-spy-assembler-0x29a-micro-backdoor/31112/
• http://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016
• http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory
• https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html
• https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html
• https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf
• https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
• https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
• https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
• https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/
• https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a
• https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c
• https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b
• https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf