DarkUniverse – the mysterious APT framework #27

**Executive summary:** This Kaspersky GReAT report details DarkUniverse, a sophisticated APT cyber-espionage framework active from 2009–2017 that used targeted spear-phishing with malicious Office documents to drop a multi-module malware suite (keylogger, POP3 credential stealer, flexible C2 via cloud storage, and a powerful command module) against around 20 victims across multiple countries; the report describes technical implementation, persistence, custom encryption, supported C2 commands, victimology and MD5 IOCs, and attributes the activity with medium confidence to the ItaDuke set of operations.