APT / THREAT GROUP

ItaDuke

aliases

Last seen:Mar 17, 2026

Intelligence Profile

ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by Kaspersky.

Threat Analysis

ItaDuke is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/

→https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html

→https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465

Quick Facts

TypeAPT / Threat Group

Aliases3

SourceMalpedia

Also Known As

SIG27DarkUniverseItaDuke

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search ItaDuke