Tracking Mini Dionis: Cozy Car’s New Ride Is Related to Seaduke
Summary: Unit 42 reported a CozyDuke (CozyCar) campaign beginning July 7, 2015, targeting government organizations and think-tanks in democratic countries through spear phishing that used compromised legitimate websites for payload delivery and command and control. The malware, called "miniDionis" in pdb strings left in the binary, drops a decoy .wav file of a female voice posing as a reporter while a secondary dropper fetches a .swf file over SSL and decodes embedded binary data into an executable disguised under names such as TimbuktuDaemon and SearchIndexer.
Key Takeaway: The executable was not seen on VirusTotal until July 9 and carried a 3/54 detection rate, so signature-based defenses had little to work with while the group ran a full command handler against its targets.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026