APT 29 – Put Up You Dukes

<p>Have you ever heard the phrase “put up your dukes” and wondered how on Earth that could equate to putting up your fists for a fight? You wouldn’t be alone in wondering. Etymologists studying this phrase have concluded that this expression, like many others that are seemingly inexplicable, likely came from rhyming slang. “Dukes of York” was slang for fork, and fork was slang for “hand” or “fist”. So the evolution of the phrase would have looked something like this:</p><p>“Put up your forks” --&gt; “Put up your dukes of York” --&gt; “Put up your dukes”</p><p>So why the language lesson? Looking at the evolution of that phrase over time helped us to answer some key questions. That same principle can be applied to nearly any discipline. In the case of cybersecurity, advanced threat actor groups are continuously changing their tactics, often very quickly, so that it can sometimes seem impossible to keep up and develop effective defensive strategies. However, analyzing the evolution of threat group attacks can help us to glean some important insights into their motivations, strategies, targets, and potentially their future campaigns.</p><p>Anomali recently published a <a href="https://forum.anomali.com/t/apt29-a-timeline-of-malicious-activity/2480">timeline of malicious activity</a> that covers a number of “dukes” put up by the Advanced Persistent Threat (APT) group “APT29,” which is one of the most sophisticated APT groups documented in the cybersecurity community. Thought to be a Russian state-sponsored group, APT29 has conducted numerous campaigns with various tactics that distribute advanced, custom malware to targets located around the globe.</p><p>Mirroring the complexity and abundance of their toolsets, APT29 is connected with a number of names. Traces of APT29 date back to 2008, but Kaspersky Labs first began attributing malicious activity to the group behind the malware dubbed “MiniDuke.” Researchers have continued to include “-duke” as a suffix for newly discovered tools, such as “PinchDuke,” “CosmicDuke,” and “OnionDuke,” leading APT29 to be commonly referred to as “the Dukes.”</p><p>APT29 has been observed to attack the same targets, including the <a href="https://www.washingtonpost.com/world/national-security/russian-government-hackers-penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html?noredirect=on&amp;utm_term=.cbd4e15ba2eb" target="_blank">2016 hack of the Democratic National Committee</a>, as other Russian state-sponsored actors. The <a href="https://forum.anomali.com/t/apt28-timeline-of-malicious-activity/2019">timeline of malicious activity for APT28</a>, the other group involved in this notorious hack, was identified and documented by Anomali.</p><p>Documentation of these high-profile APT groups presents a sobering reality – the tactics and landscape of war and conflicts are evolving at an unprecedented rate. As APT groups sponsored from countries around the world continue to be documented, these groups will continue to change their methods, tactics, and tools they use to gain entry to their targets. Therefore, it is crucial to be aware of what groups target which industries to assist in identifying the tactics and indicators associated to the group. Such knowledge gives cyber defenders the chance to put up some “dukes” of their own.</p><p><em><a href="https://forum.anomali.com/t/apt29-a-timeline-of-malicious-activity/2480">Read the full APT29 timeline and analysis on the Anomali Forum</a></em></p>