Malware

OnionDuke

OnionDuke is a new sophisticated piece of malware distributed by threat actors through a malicious exit node on the Tor anonymity network appears to be related to the notorious MiniDuke, researchers a

OnionDuke is a Windows malware family operated by APT29.

Background

F-Secure researchers identified OnionDuke as an advanced malware family spread by attackers who weaponized a rogue exit node on the Tor anonymity network, and found it to be tied to the well-known MiniDuke. The analysts noted that, from at least February 2014 onward, the operators also pushed the malware via trojanized copies of pirated software shared on torrent sites.

Source: Malpedia (Fraunhofer FKIE).