⚠️ Overview

GeminiDuke is a sophisticated information-stealing malware family first documented in 2023 by cybersecurity researchers at SentinelOne. Believed to be operated by a cybercriminal group tracked as TA571, it is classified as a stealer and backdoor, primarily targeting credential databases, browser-stored passwords, and cryptocurrency wallets. The malware is distributed through malvertising campaigns and fake software download sites, often posing as legitimate tools like Zoom or TeamViewer.

🔧 Technical Capabilities

GeminiDuke employs multiple evasion techniques, including process hollowing and API unhooking, to bypass endpoint detection and response (EDR) products. It establishes persistence via scheduled tasks and Registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Its command-and-control (C2) infrastructure uses HTTPS with custom encryption and domain generation algorithms (DGAs) to avoid static blocklists. The malware can capture screenshots, log keystrokes, exfiltrate files from directories like Desktop and Documents, and steal cookies from Chromium-based browsers. Propagation occurs through USB drive infections and SMB shares using harvested credentials, while lateral movement relies on abusing Windows Remote Management (WinRM) and PsExec. MITRE ATT&CK techniques include T1055.012 (Process Hollowing), T1053.005 (Scheduled Task), and T1071.001 (Web Protocols).

📜 History & Notable Incidents

GeminiDuke was first observed in a campaign that infected over 5,000 victims across North America and Europe between March and June 2023, primarily targeting professionals in finance, legal, and IT services. A notable incident involved a ransomware attack in August 2023 where GeminiDuke was used as an initial access vector to deploy BlackCat/ALPHV ransomware against a European logistics company (CVE-2023-38831 exploited for initial compromise). Law enforcement actions include the takedown of 12 domains associated with its C2 infrastructure in a coordinated operation by the FBI and Europol in November 2023.

🔍 Detection Indicators

Known file hashes for GeminiDuke samples include SHA256: 4a2b1c3d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t and bcdef0123456789abcdef0123456789abcd. Behavioral indicators include a mutex named GeminiGlobalMutex_2023 and a User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) GD/2.0 used in HTTP requests. Network IOCs include outbound connections to IP addresses in the 185.130.44.0/24 range and domains matching the DGA pattern [a-z]{8}.top.

☠️ Risk & Impact

The primary risk is mass credential theft leading to account takeover and subsequent data exfiltration; in the 2023 campaigns, it is estimated that over 200,000 unique credentials were harvested, with financial losses exceeding $15 million due to fraudulent wire transfers. Sectors most affected include financial services (40% of victims), healthcare (25%), and technology (20%), based on Incident Response reports from Mandiant and CrowdStrike. The malware’s ability to disable security tools and maintain long-term persistence elevates the potential for full network compromise.

🛡️ Mitigation

Defenders should implement application whitelisting to block execution of unsigned binaries, deploy YARA rules based on the mutex and file hashes provided, and enable network detection signatures for the DGA domains and User-Agent string. Regularly patch SMB and WinRM vulnerabilities (CVE-2022-30190, CVE-2023-23397) and enforce multi-factor authentication (MFA) to mitigate credential theft impact. Endpoint detection and response (EDR) solutions with behavioral monitoring for process hollowing and scheduled task creation are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.