Duqu

Duqu is a highly sophisticated cyberespionage malware platform and threat cluster closely linked by researchers to Stuxnet through shared developmental lineage, code relationships, and platform design. It is best known for the original Duqu malware disclosed in 2011 and the later Duqu 2.0 platform uncovered in 2015. Duqu 2.0 is widely regarded as one of the most advanced in-memory espionage frameworks publicly documented, featuring a modular architecture with more than 100 observed plugin variants and support for multiple command-and-control transports including HTTP, HTTPS, SMB pipes, and custom TCP. Researchers have also described an intermediate evolutionary stage referred to as Duqu 1.5. Duqu operations have targeted high-value organizations and event-linked environments associated with sensitive diplomatic activity, including venues connected to the P5+1 nuclear negotiations with Iran. Victims have also been identified in Western countries, the Middle East, and Asia, and reporting has noted compromises tied to a commemorative event related to Auschwitz-Birkenau. The actor has additionally been associated with intrusions into security vendors and with utilitarian targeting of organizations that could enhance operational reach, including industrial or ICS-relevant entities. Operationally, Duqu has demonstrated strong capabilities in stealth, privilege escalation, lateral movement, and defense evasion. The original Duqu used msiexec to execute malicious Windows Installer packages. Duqu 2.0 also used MSI-based loaders for deployment and remote execution, including execution through services or Task Scheduler, with encrypted payloads decrypted via installer properties. The platform emphasized memory residency, modular plugin loading, and kernel-level operations. Public reporting states that Duqu 2.0 exploited CVE-2015-2360 in the Windows kernel to gain elevated privileges and load unsigned kernel-mode components, and its operators also used behavior consistent with exploitation of CVE-2014-6324 for domain privilege escalation as well as pass-the-hash for lateral movement. Duqu 2.0 supported process injection and migration behaviors, kernel-driver-assisted evasion, and covert communications techniques such as hiding command-and-control traffic inside image files and varying HTTP user-agent strings. Reporting also describes a malicious NDIS filter driver used to redirect traffic for covert tunneling inside victim networks. Researchers have noted deliberate false-flag artifacts in Duqu 2.0, including strings apparently intended to mislead attribution. Despite longstanding speculation about state sponsorship, public reporting in the supplied material does not provide definitive attribution to a specific country. Known related names and variants include Duqu, Duqu 1.5, and Duqu 2.0.