PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs

Volexity observed five coordinated post-election spear-phishing waves attributed to The Dukes (APT29/Cozy Bear) targeting U.S. think tanks, NGOs and universities; attackers used malicious Word/Excel attachments, LNK/PowerShell droppers and password-protected ZIPs to deploy the PowerDuke backdoor. PowerDuke employs anti-VM checks, steganography (PNG alternate data streams), persistence via rundll32 and a broad command set for reconnaissance and control; the report provides file hashes, domains, IPs and ASN information for detection and response.