miniduke_indicators_public

## Executive summary This CrySyS/Kaspersky technical report documents the Miniduke APT: multi-stage polymorphic malware with stage-2/3 payloads delivered via malicious documents, encrypted GIF-wrapped executables, and C2 discovery via Google/Twitter queries; the report enumerates numerous MD5/SHA1 IOCs, C2 servers (e.g., news.grouptumbler.com / 200.63.46.23), network request formats (Base64-like GET parameter decoding, geoip/twitter/google lookups), persistence artifacts (startup .lnk and .tmp/.cat/.db DLL exports), and detection signatures and heuristics for incident response.