The Dukes R&D Finds a New Anti-Analysis Technique
Summary: Unit 42 observed the Dukes threat group (APT29, CozyBear) use a malicious Excel .xls file with a macro in an August 10, 2016 attack, dropping a DLL to %APPDATA%\Adobe\qpbqrx.dat and executing it via rundll32.exe with the exported function called by ordinal 2. The DLL left its exported function names blank, which hid them from analysts and exploited a bug in IDA version 6.9.160222 that was fixed in version 6.95.160808, whose release notes were posted two days before the attack.
Key Takeaway: Unit 42 believes the group likely monitors IDA release notes for bug fixes to turn them into anti-analysis techniques, meaning the tooling your reverse engineers rely on can become an evasion surface within days of a patch.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026