PinchDuke, 3 Minute Profile

The PinchDuke campaign, which operated from November 2008 until summer 2010, is believed to be the first campaign of the Duke malware family. PinchDuke targeted political organizations in Georgia, Turkey, Uganda, and the United States. The PinchDuke campaigns began 11 days after President Obama’s April 5, 2008 speech concerning the deployment of missile defenses in Poland. In 2009 the campaign targeted the Ministry of Defense in Georgia, the ministries of foreign affairs in Turkey and Uganda, a United States foreign policy think tank, organizations associated with NATO exercises in Europe, and the Georgian Information Centre on NATO. In 2010, the group also targeted Kazakhstan, Kyrgyzstan, Azerbaijan, and Uzbekistan. The political nature of the targets suggests that the campaigns may have been state sponsored. The selection of targets closely mirrors those of the later APT28/ Sofacy campaigns, which is widely believed a Russian state sponsored threat actor.