FatDuke
Software · ATTACK:enterprise:S0512
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0512",
"title": "FatDuke",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0512",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--54a01db0-9fab-4d5f-8209-53cef8425f4a",
"external_id": "S0512",
"domain": "enterprise",
"created": "2020-09-24T13:23:45.162Z",
"modified": "2025-04-25T14:43:21.871Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET Dukes October 2019",
"url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--052c54bf-b92b-4a7e-bca4-bc884437a327
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1036.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10d0c930-1470-4d2e-aff8-0bf42c42d2f0
ESET Dukes October 2019ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0512
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27785084-70d5-4b4d-b8d0-9ab250ade9f5
ESET Dukes October 2019 · Secureworks IRON HEMLOCK ProfileATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--277c6e7e-8c39-4c41-ac6f-f740bfb862b8
ESET Dukes October 2019ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:S0512
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28fa44de-4b89-4ce6-a29c-895e42a30628
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3056fa10-d4a3-4830-96b7-987b10b5ae70
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b81ee4f-c583-477f-b2e4-d1801da7bac8
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e2842c6-ce4c-4204-9f29-4442a1859f12
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f5fd1ed-a91e-4a9e-b2e8-6c45cc31e065
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--603725ac-1b50-482d-b3f5-f657fdd082af
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67c21ae7-5dc3-4439-b5d1-df937abac3ad
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6af4810f-3abe-43eb-92b0-ee8fefc2a4b9
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1090.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--733eae48-a5e2-4e82-b4a6-950c7a660e7e
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7380936d-51af-4ee3-b729-9c56a203bdee
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b17bab3-6c5a-4db2-969b-7724f71afc09
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8600308b-3a73-40bd-bca0-970477ca11fb
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96a31073-f6b7-463d-9816-d59014ba4adc
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b244899c-bb0a-46c0-8f38-23d867a8a8b2
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbb5c722-bc07-4f35-a8cd-d6e1acc839d5
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6a29b67-d323-4579-9c8e-1c95a0ea7c20
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea6a1c47-237a-4bc6-a048-9f45dd48fe02
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1a70ff1-a4e7-437e-96fd-8017feea0b5a
ESET Dukes October 2019ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbe5352c-7c4f-437c-a439-d212ba6d439b
ESET Dukes October 2019