Duuzer

Duuzer is a Lazarus-linked Windows backdoor trojan associated with cyber-espionage activity against South Korean organizations, particularly campaigns observed in 2015 that targeted sectors including manufacturing. It has been tracked alongside other Lazarus malware such as Brambul and Joanap and is part of the broader malware ecosystem tied to the North Korean threat cluster also known as Hidden Cobra. Duuzer is notable both as an operational implant and as a code lineage reference point, with later malware such as Rising Sun reported to reuse portions of its source code.

Public reporting links Duuzer to intrusions intended to compromise victim systems and enable remote control, post-compromise activity, and data theft. The malware is characterized as a backdoor trojan rather than a self-propagating worm or ransomware component. Its use fits Lazarus tradecraft seen across multiple campaigns, including code reuse, modular tooling, and deployment in targeted operations against strategic regional victims. Duuzer has been referenced in connection with the DarkSeoul and Operation Troy historical tracking of Lazarus activity, although the strongest direct reporting places it in 2015 South Korea-focused operations.

Duuzer targets Windows environments. High-confidence reporting supports its role in establishing unauthorized access and supporting follow-on espionage objectives, including exfiltration of victim data. It is associated with a state-linked threat actor known for blending espionage, sabotage, and financially motivated operations, but Duuzer itself is most directly tied to targeted backdoor access in espionage-oriented intrusions.