FatDuke is a sophisticated malware that was first detected in 2013 and primarily targets government entities, defense contractors, and research institutions. The malware is known to be spread through spear-phishing attacks and has been linked to a group of hackers called APT29 or Cozy Bear. Once installed on a victim's computer, the malware can gather sensitive information, steal passwords, and carry out other malicious activities.
In recent years, researchers have observed the presence of FatDuke and another malware named Crutch on the same machine. Crutch is also a backdoor Trojan that has been linked to APT29, and its purpose is to provide additional access to compromised systems. This discovery suggests that APT29 may be using multiple attack vectors to infiltrate their targets and highlights the sophistication of their operations.
The presence of FatDuke and Crutch on the same machine raises concerns regarding the potential damage that could be inflicted on an organization if both malwares were used in tandem. It underscores the importance of implementing robust security measures and developing incident response plans to detect and mitigate threats effectively. As the threat landscape continues to evolve, organizations must remain vigilant in identifying and mitigating potential threats such as FatDuke and Crutch to protect themselves from cyberattacks.