PowerDuke
Software · ATTACK:enterprise:S0139
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0139",
"title": "PowerDuke",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0139",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--00c3bfcb-99bd-4767-8c03-b08f585f5c8a",
"external_id": "S0139",
"domain": "enterprise",
"created": "2017-05-31T21:33:19.746Z",
"modified": "2025-04-25T14:42:30.325Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "PowerDuke"
},
{
"source_name": "Volexity PowerDuke November 2016",
"url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0db8a021-2f3a-41cc-abc6-d8723c7e802b
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18f4bc4e-ef29-4fe4-ace3-c4671f94ccef
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cbf5583-626a-4a24-bc59-f3b973752cee
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fda6ff7-a344-4bc3-b545-4083cc15290d
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24ea53e3-a51f-4c4a-b3de-2e1d09ed69e8
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43d85ed6-223e-4402-bd29-be10a872359d
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5135ba35-04b7-4cfc-bc6c-03f63206e757
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5efe685d-66a6-4f1f-8779-4aae5db859d0
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62f9aa2c-b0c1-4028-a2b8-c436e30ace4b
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b38f460-e309-4ab1-bbc9-bd0bb30f4af9
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--789cf81d-bfc9-4c1a-a34a-57e41981894a
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ef27cd6-3909-4174-b57c-3dbe3061a6dd
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1564.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91f59958-db5f-429c-9608-a033ea68486b
Volexity PowerDuke November 2016ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0139
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da3a85c7-7590-48b1-8a22-2f8b00060f83
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e465e173-04d8-4a2b-8953-a2fa3b44aec0
Volexity PowerDuke November 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0b00a47-9d63-4d05-b771-022a21a4ed06
Volexity PowerDuke November 2016