Duqu 2.0

  • The way of propagation

    Social engineering , USB drives

  • Purpose/Functions

    Cyberespionage , Data theft , Data wiping , Remote control , Surveillance
  • Special features
    An updated version of the infamous 2011 Duqu malware

  • Targets

    Electronics manufacturing , High technology companies , Information technology , Politicians , Private companies , Software companies , Specific individuals
  • Artefacts/Attribution
    Duqu 2.0 is an updated version of the infamous 2011 Duqu malware, which is associated with an APT group that went dark in 2012.
  • Description

    A modified version of the infamous 2011 Duqu malware. It was found on Kaspersky’s internal networks in the spring of 2015 after leveraging a vulnerability in Windows kernel; it was also used to gather information related to the P5+1 (US, UK, France, Russia, China, and Germany) talks concerning the Iranian nuclear deal later reached in 2015.

    Additional information

© 2018 AO Kaspersky Lab. All Rights Reserved. Privacy Policy
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com