Duke APT group's latest tools: cloud services and Linux support - F-Secure Weblog : News from the Lab

F-Secure details Duke APT’s recent SeaDuke and CloudDuke toolsets: SeaDuke is a Python-written cross-platform trojan (Windows and Linux), while CloudDuke is a modular framework (loader, downloader 'DropperSolution', and trojans 'BastionSolution' and 'OneDriveSolution') that leverages Microsoft OneDrive for command-and-control and exfiltration. The report describes spear-phishing distribution (eFax-themed decoys), reuse of code/frameworks across languages to evade detection, sample PDB strings, file hashes, and lists compromised servers and hosting URLs as IOCs.