{
	"id": "902f186c-38dd-4830-9c38-0db7858d11fd",
	"created_at": "2026-04-06T00:11:08.547155Z",
	"updated_at": "2026-04-10T03:20:47.84566Z",
	"deleted_at": null,
	"sha1_hash": "526479f6b71e9d3f9b2f22b80b3f303e1f099a1a",
	"title": "DUSTMAN (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 29373,
	"plain_text": "DUSTMAN (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 15:30:59 UTC\r\nIn 2019, multiple destructive attacks were observed targeting entities within the Middle East. The National Cyber\r\nSecurity Centre (NCSC), a part of the National Cybersecurity Authority (NCA), detected a new malware named\r\n\"DUSTMAN\" that was detonated on December 29, 2019. Based on analyzed evidence and artifacts found on\r\nmachines in a victim’s network that were not wiped by the malware. NCSC assess that the threat actor behind the\r\nattack had some kind of urgency on executing the files on the date of the attack due to multiple OPSEC failures\r\nobserved on the infected network. NCSC is calling the malware used in this attack \"DUSTMAN\" after the\r\nfilename and string embedded in the malware. \"DUSTMAN\" can be considered as a new variant of \"ZeroCleare\"\r\nmalware,\r\npublished in December 2019.\r\n[TLP:WHITE] win_dustman_auto (20251219 | Detects win.dustman.)\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dustman\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman"
	],
	"report_names": [
		"win.dustman"
	],
	"threat_actors": [],
	"ts_created_at": 1775434268,
	"ts_updated_at": 1775791247,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/526479f6b71e9d3f9b2f22b80b3f303e1f099a1a.pdf",
		"text": "https://archive.orkl.eu/526479f6b71e9d3f9b2f22b80b3f303e1f099a1a.txt",
		"img": "https://archive.orkl.eu/526479f6b71e9d3f9b2f22b80b3f303e1f099a1a.jpg"
	}
}