Campaigns / Malware / Family

Cosmicduke

CosmicDuke is malware that was used by APT29 from 2010 to 2015.

0New IOCs · 24h

15New IOCs · 7 days

15Indicators tracked

1Independent feeds

2026-10-10 17:46Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

Hash14
IP1
Malware15

MITRE ATT&CK lists this as malware CosmicDuke. Explore the ATT&CK matrix →

Where its infrastructure is hosted

🇩🇪 Germany1

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-10 17:46	IP	94.242.199[.]88	Contacted by malware	—
2026-10-10 15:26	SHA256	f4824a5514180274a37530c6e03ebf1ad2321d610902d7dbb3c114f23f6f5aaf	Malware sample	—
2026-10-09 02:31	SHA256	01ae01c0c3490d391d31503ec75b60ea87f3c168fb54e3db36b54ad2c221ccf0	Malware sample	—
2026-10-09 02:17	SHA256	04311e5a26774cec469649d9caa9cc3a829c6e2c3f41272c6a7cb3a3312bd567	Malware sample	—
2026-10-09 02:02	SHA256	0003f8975bd21adc3e4fd91f7de998d8915457277d43e3ca09038e126107e7dc	Malware sample	—
2026-10-09 02:02	SHA256	010a5c6c947be2c0fdc20ce9b712c42e95cc06b612d4c4aca1ddbe8a56f09e71	Malware sample	—
2026-10-09 02:02	SHA256	04372995733a70052c233ab82fc7b7e30de0caf6ce497b8646e3e313c238dbec	Malware sample	—
2026-10-09 02:02	SHA256	043c2cfcd6f64d63eb0979f7486a43a37cf0122e77792423e87763a6f9b8988f	Malware sample	—
2026-10-08 15:25	SHA256	00aa1a1a2c64d53ecd663fa4dbdaca225e29c90a3b850d80bb6dd962ad8d4613	Malware sample	—
2026-10-08 15:04	SHA256	010c82e5151320a07d30c53e254260bd6022e1ccd268c06d498734865e74a40d	Malware sample	—
2026-10-08 15:04	SHA256	0265c3aeb6706d1cb1a97f8486ffce09cc32c9ef61e74e718211d7731eb59999	Malware sample	—
2026-10-08 15:04	SHA256	03464c8e3ef103d46f224f1c6abe57ae11a4f58602a1034f0c563733696d39b7	Malware sample	—
2026-10-08 15:04	SHA256	04ab220e6b088e796f85922ce4efab998fb72ff55cd168daf779315bd4564ebd	Malware sample	—
2026-10-08 14:44	SHA256	00e50aefb98e5bab6a413a8c5645e7afcf9154dcd7f5105731f494c91a1e93fa	Malware sample	—
2026-10-07 02:03	SHA256	f57e39062e44be9a15c352945e0d5212baf37cc17b61ca6fc685c5f5f29551c0	Malware sample	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check