Tracking MiniDionis: CozyCar’s New Ride Is Related to Seaduke - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 details a CozyDuke/CozyCar campaign that uses the miniDionis malware, delivered through spearphishing and compromised websites, including decoy media and staged payloads, to beacon to a C2 server with RC4-encrypted cookies and network-communication techniques; the report provides IoCs, cryptographic details, and analysis of the malware's structure, commands, and potential impact on government and think-tank targets.