ItaDuke is a cyber espionage threat actor first publicly identified in February 2013, notable for using Italian-language shellcode comments drawn from Dante Alighieri's Divine Comedy. The group primarily conducted targeted spear-phishing campaigns, often themed around Uyghur and Tibetan human rights issues, using malicious PDF files to exploit zero-day vulnerabilities in Adobe Reader. A distinctive tactic employed by ItaDuke involved using Twitter accounts to host command-and-control server URLs for evasion. ItaDuke is assessed with medium confidence to be part of the broader DarkUniverse APT framework, which was active from at least 2009 to 2017. DarkUniverse was a fully featured, modular espionage toolkit capable of keylogging, intercepting email traffic, capturing screenshots, stealing credentials, and exfiltrating system information, and is characterized by its just-in-time compilation of malware samples tailored for each victim.

Aliases del actor

DarkUniverseSIG27está vinculado a activistas tibetanosuigurosaunque también ha atacado a países como SiriaIránAfganistánTanzaniaEtiopíaSudánRusiaBelarúsel Emirato Arabe Unitarioo nombres alternativos para este grupose ha enfocado en regiones geopolíticamente sensiblesincluyendo TibetUyghurSiriaTansaniael Emirato de Abu Dabioficialesreconocidos ni una red de apoyo conocida

Actores similares

Harvesterapt · 0everestransomware · 365dispossessorransomware · 344babuk2ransomware · 180againstthewestransomware · 2lunalockransomware · 2mosesstaffactor · 2redalertransomware · 2redransomwareransomware · 2Scattered Spideractor · 2