Duqu Duqu

  • First known sample

    2008

  • Discovery

    2011

  • Current status

    Inactive since 2012

  • Type

    Trojan

  • Targeted platforms

    Windows

  • TOP targeted countries

    France , Hungary , Iran , Sudan

  • Connected attacks

    Wiper

  • The way of propagation

    Social engineering

  • Purpose/Functions

    Cyberespionage
  • Special features
    The attackers were looking for information related to the production control systems and trade relationships of particular organizations.

  • Targets

    No specific targets
  • Artefacts/Attribution
    "Tilded" team, related to Stuxnet and Flame developers
  • Description

    This suspected nation-state actor was active from 2008 to 2012. This group used zero-day exploits and spear-phishing emails to infect victims for cyber-espionage purposes. The victims represented thirteen different countries across three continents; one notable target was Iran’s nuclear program.

    Additional information

© 2024 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com