Loading malware…
Duqu is a highly sophisticated Windows malware platform widely described as closely related to Stuxnet and used in targeted espionage operations. Multiple sources in the content characterize it as an information-stealing malware used in targeted attacks, with a focus on gathering intelligence rather than causing PLC sabotage; it is specifically described as attempting to gather information on industrial control systems and as lacking the PLC functionality present in Stuxnet. Researchers connected Duqu to Stuxnet early through developmental similarities, including shared or very similar driver-based injection techniques, overlapping encryption approaches, and links involving Stuxnet kernel drivers such as mrxcls.sys and Duqu’s so-called Tilde-D platform. Some reporting also notes that the evidence for direct common authorship was debated, but the developmental relationship was consistently highlighted.
Operationally, Duqu installs a malicious driver and establishes persistence by creating a new Windows service that loads that driver at system start. The driver was made to appear legitimate by being digitally signed with a valid stolen private key/certificate; named examples in the content include cmi4432.sys and jminet7.sys, with one sample signed using a certificate belonging to C-Media Electronics in Taipei that was later revoked. The driver decrypts and executes an encrypted payload DLL, injects it into processes, and additional modules can then be pushed and executed remotely. Reported modules include components that copy data to a staging area, compress it, and XOR-encrypt it before exfiltration; keylogging and user-mode rootkit functionality were also described. Duqu supported remote control and installation of new code on infected systems, and adversaries could instruct it to spread laterally by using compromised credentials to schedule tasks on remote machines.
The content also describes an evolutionary progression within the family. A claimed intermediate variant, "Duqu 1.5," was presented as a missing link between Duqu 1.0 and the later in-memory Duqu 2.0 platform. Its loading chain reportedly used a trojanized floppy kernel driver signed with a stolen certificate to load a registry-based virtual file system, then an in-memory orchestrator, then an on-disk virtual file system and plugins for spreading and backdoor access. Kaspersky reporting in the content further states that part of Duqu’s Payload DLL framework was written in an unusual, unidentified programming language with a highly event-driven, object-oriented architecture, distinct from the standard C++ used elsewhere in the malware.
Targeting described in the content includes Certificate Authorities, small CAs, industry systems, and other key sites; attacks were reported in Iran and Sudan, and one command-and-control server was reported in India before being blacklisted. High-confidence indicators and artifacts mentioned in the content include the service-based driver loading behavior; the SYS filenames cmi4432.sys and jminet7.sys; encrypted PNF payload files; sortXXXX.nls modules associated with malicious activity and command-and-control; and the Tilde-D temporary-file/platform convention associated with Duqu and also noted in comparisons with Stuxnet and Wiper.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2011-3402 (Windows TrueType Font Parsing RCE) Vulnerability in the Windows kernel’s TrueType font parsing engine (win32k.sys)... Used in attacks linked to targeted threats (e.g., Duqu malware family). ... patched in December 2011. | Used in attacks linked to targeted threats (e.g., Duqu malware family).
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers connected Duqu to the development of Stuxnet early on.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"
"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The PNF file is an encrypted DLL that is decrypted and injected into arbitrary system processes.
Duqu and Stuxnet both use a kernel driver to decrypt and load encrypted DLL (Dynamic Load Library) files. The kernel drivers serve as an “injection” engine to load these DLLs into a specific process.
"Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code." / "Astaroth can create a new process in a suspended state... unmap its memory and replace it with malicious code." / "Emotet uses a copy of certutil.exe stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code."
The kernel drivers for both Stuxnet and Duqu use many similar techniques for encryption and stealth, such as a rootkit for hiding files.
“Duqu… a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.”
installs drivers and encrypted DLLs... The PNF file is an encrypted DLL that is decrypted and injected into arbitrary system processes.
temporary Windows files generated by Wiper begin with a tilde character (~), followed by the letter d (either capital or lower case), followed by other letters or numbers. This “tilded platform,” as researchers have come to call the convention, is also found in both Stuxnet and Duqu.
The PNF file is an encrypted DLL that is decrypted and injected into arbitrary system processes.
Duqu and Stuxnet both use a kernel driver to decrypt and load encrypted DLL (Dynamic Load Library) files. The kernel drivers serve as an “injection” engine to load these DLLs into a specific process.
"Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code." / "Astaroth can create a new process in a suspended state... unmap its memory and replace it with malicious code." / "Emotet uses a copy of certutil.exe stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code."
"actors leverage legitimate credentials to log into external remote services"; "used legitimate credentials to gain initial access, maintain access, and exfiltrate data"; "used valid accounts for initial access and privilege escalation"
“AppleJeus delivered components using a Windows Installer package (.msi)… executed the 3CXDesktopApp.exe…”, “APT38 has used msiexec.exe to execute malicious files.”, “Rancor has used msiexec to download and execute malicious installer files over HTTP.”, “TA505 has used msiexec to download and execute malicious Windows Installer files.”
And while Stuxnet and Duqu each “have variants where the kernel driver file is digitally signed using a software signing certificate,” Dell says this commonality is insufficient evidence of a connection “because compromised signing certificates can be obtained from a number of sources.”
Multiple malware families are described as identifying/enumerating open windows or capturing foreground window titles (e.g., via EnumWindows, GetForegroundWindow, GetWindowText) to understand user activity and provide context for keylogging/screencapture.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”
It communicates with a command server in India... Both groups above also contain another module, sortXXXX.nls... It seems to be responsible for the malware’s malicious activities, such as command and control communications.
The code in question is part of the Payload DLL, a section of the trojan that sends and receives instructions from an outside source once it has infiltrated a system.
Duqu provides attackers with remote access to compromised computers with the ability to run arbitrary programs, and can theoretically be used to target any organization, Dell said.
"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."
58 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed among historically significant sophisticated malware families that drew deep technical analysis.
An information-stealing rootkit described as having been based on Stuxnet.
Malware used to gather information on industrial systems.
An information-stealing malware related to Stuxnet, apparently tailored to steal information from industrial control systems rather than sabotage them.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.