The Dukes: 7 years of Russian cyberespionage

**Executive summary:** The F-Secure whitepaper analyzes seven years of activity by the Dukes (APT29), describing their arsenal of malware families, operational timelines, infection vectors (notably spear-phishing and malicious Tor/torrent distribution), use of exploits including a zero-day, extensive IOCs (hashes, domains, IPs), and provides contextual attribution linking the group’s targeting and operational patterns to Russian state-sponsored cyberespionage.