Loading story…
Kaspersky researchers reported that the Duqu espionage platform continued to evolve after its initial discovery, identifying additional malware components and operational links tied to the broader campaign. The report highlighted newly observed elements dubbed Mr. B. Jason and Dexter, which appeared to extend the toolkit used by the attackers for stealthy intrusion, persistence, and intelligence collection on targeted systems.
The findings reinforced that Duqu was not a single isolated malware sample but a modular, actively maintained operation with multiple moving parts and likely dedicated operators. By connecting these components to the wider Duqu ecosystem, the research showed that the threat actors were refining their capabilities and sustaining a long-term cyber-espionage effort against selected victims.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Securelist published technical analysis of the Duqu 2.0 persistence module, revealing implementation details of how the malware maintained access on compromised systems. This was a distinct disclosure predating later 2021 reporting on continued Duqu activity.
Kaspersky researchers disclosed that a core Duqu payload DLL framework appeared to be written in an unidentified object-oriented, event-driven language rather than standard C++. The company said the unusual framework hindered analysis and suggested a highly sophisticated, possibly nation-state-backed development effort.
Securelist published a report titled "The Duqu Saga Continues: Enter Mr. B. Jason and TV’s Dexter," indicating ongoing analysis and new technical details related to the Duqu malware campaign.
McAfee Labs reported that Duqu was closely related to Stuxnet but built for espionage, targeting a small number of organizations including certificate authorities and other key sites. The analysis described signed and unsigned drivers, encrypted modules, command-and-control infrastructure in India, and capabilities such as remote module installation and antivirus evasion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcesecurelist.com
Open sourcetechspot.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Qadars** as a banking Trojan focused on web-injection fraud against financial institutions, with the heaviest activity observed in the Netherlands and additional targeting in France, Canada, India, Australia, and Italy. The malware hooked **Firefox** and **Internet Explorer** to perform man-in-the-browser attacks, delivered region-specific webinjects, stored downloaded configurations encrypted in the Windows registry, and later added **FTP credential theft**. Campaigns were linked to **pay-per-install** distribution and later to the **Nuclear Exploit Kit**, while some operations also used **Android/Perkele** malware to intercept SMS transaction codes and bypass two-factor authentication during fraudulent transfers. Later reverse engineering tied a newer sample to a likely **Qadars 3.0.0.0** variant that introduced a **domain generation algorithm (DGA)** for command-and-control discovery, a capability not highlighted in earlier reporting on version 2. The malware was found to generate up to **200 candidate domains** per cycle, resolve them with `gethostbyname`, and retry after a **20-second** sleep if none were reachable. The DGA was described as **time-dependent and deterministic**, seeded by the current week so domains rotated every seven days, producing **12-character** second-level domains across **`.com`**, **`.org`**, and **`.net`** to make infrastructure tracking and takedown more difficult.
Aug 15, 2026
Kaspersky reported that the **CozyDuke** advanced persistent threat conducted targeted intrusions using spearphishing emails and malware-laced documents to compromise victims that included government organizations, diplomatic entities, and other high-profile institutions. The campaign relied on social engineering themes tied to political and security events, with malicious attachments and links delivering backdoors designed to establish persistence, collect system information, and enable follow-on access. The operation was described as part of a broader espionage effort linked to tools and tactics overlapping with other Duke malware families, indicating a coordinated threat actor with a mature toolkit. Researchers said the malware used stealth and modular functionality to evade detection and maintain long-term access, underscoring the risk posed by state-aligned intrusion sets that blend tailored phishing, custom implants, and quiet data collection against strategic targets.
Jul 12, 2026
Kaspersky detailed a highly sophisticated cyber-espionage operation attributed to the **Equation Group**, describing a malware ecosystem with multiple toolsets, covert command-and-control methods, and the ability to maintain long-term access on victim networks. The report linked the group to a broad range of implants and frameworks used for surveillance, data theft, and lateral movement, and said its tradecraft ranked among the most advanced seen publicly at the time. A standout finding was the group’s apparent ability to reprogram hard drive firmware from major manufacturers, giving attackers persistence that could survive disk formatting, reinstallation, and operating system replacement. Researchers said the platform also used stealth techniques such as encrypted virtual file systems, hidden storage areas, and modular malware components, underscoring the risk posed by state-grade operators capable of embedding malicious functionality deep below the operating system layer.
Jul 12, 2026