Power Duke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs
Summary: Volexity observed five spear-phishing waves launched within six hours of Donald Trump becoming President-Elect on November 9, 2016, targeting U.S. think tanks and NGOs focused on national security, defense, international affairs, and public policy. The emails came from attacker-created Gmail accounts and apparently compromised Harvard Faculty of Arts and Sciences accounts, and Volexity attributed the activity to The Dukes (APT29/Cozy Bear), which it had also tied to the DNC breach.
Key Takeaway: The Dukes had been targeting think tanks and NGOs heavily since July 2015, and the PowerDuke backdoor first seen in August 2016 was reused in these post-election attacks, hidden inside PNG images via steganography and loaded only in memory through rundll32.exe.
Read the original at Volexity Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026