PolyglotDuke
Software · ATTACK:enterprise:S0518
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0518",
"title": "PolyglotDuke",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0518",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--3d57dcc4-be99-4613-9482-d5218f5ec13e",
"external_id": "S0518",
"domain": "enterprise",
"created": "2020-09-23T15:42:59.822Z",
"modified": "2025-04-16T20:38:03.362Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET Dukes October 2019",
"url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--190057d5-13ad-40d2-a2f0-0177850e2905
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--194d773b-a9b6-43fc-8113-8e120be95c5c
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b45a635-4384-4cce-ac50-49826659dcb2
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28d3336f-108b-40fb-b3d7-9ec4311931c4
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f25c2ba-ee4b-41e7-9cf9-7a0960f3e77c
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--630d1f21-549f-415a-968c-bd3dc3c6fb7f
ESET Dukes October 2019ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6aaca244-805c-4aba-b923-40407b034662
ESET Dukes October 2019 · Secureworks IRON HEMLOCK ProfileATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fd03410-47ca-4ddc-9202-8f4a7558b263
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a273ce5e-9ca8-4093-a815-3a3a60a16a97
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9342a76-171e-4831-96b7-d998a6de8282
ESET Dukes October 2019ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:S0518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eac2781c-7025-47b9-8982-9d037a94c33f
ESET Dukes October 2019ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe2eb5b7-7ae1-4df1-a49e-ad13f50510e8
ESET Dukes October 2019