But then , following an upsurge in attacks in the second half of 2014 , GReAT characterized MiniDuke , CosmicDuke and the actor ’s Nemesis Gemina project - targeting government , diplomatic , energy , military and telecom operators - as ‘ one of the world ’s most unusual APT operations ’ due to : • Its use of a customized backdoor written in Assembler using ‘ old school ’ virus writing techniques and habits • Stealthy transfer of updates as executables hidden inside GIF files ( a form of steganography )