PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs

Volexity observed five coordinated post‑election spear‑phishing waves attributed to The Dukes (APT29/Cozy Bear) targeting think tanks, NGOs and universities. Attack vectors included malicious Word macros, password‑protected ZIPs containing LNK dropper files and executables, use of steganography/ADS to hide PowerDuke backdoor components, anti‑VM checks, and multiple C2 servers and domains; the report provides file hashes, filenames, domains and IPs for detection and response.