View source for The MiniDuke mystery: PDF 0-day government spy assembler 0x29A micro backdoor

{{Publication
|Type=Blogpost
|Link=http://www.securelist.com/en/blog/208194129/The_MiniDuke_Mystery_PDF_0_day_Government_Spy_Assembler_0x29A_Micro_Backdoor
|Author=GReAT
|NomRevue=Securelist
|Date=2013-02-27
|Editor=Kaspersky lab
|Year=2013
|Botnet=MiniDuke
|Abstract=On Feb 12th 2013, FireEye announced the discovery of an Adobe Reader 0-day exploit which is used to drop a previously unknown, advanced piece of malware. We called this new malware “ItaDuke” because it reminded us of Duqu and because of the ancient Italian comments in the shellcode copied from Dante Aligheri’s “Divine Comedy”.

Since the original announcement, we have observed several new attacks using the same exploit (CVE-2013-0640) which drop other malware. Between these, we've observed a couple of incidents which are so unusual in many ways that we’ve decided to analyse them in depth.
}}