Duqu
MITRE ATT&CK: S0038 View on attack.mitre.org
Aliases: Duqu
- First seen
- 2011-09-01 00:00:00
- Malware type
- backdoor, spyware
- Family
- Malware family
- Operating systems
- windows
- Last IoC activity
- 2026-06-24 13:45:04
- Profile updated
- 2026-07-07 12:52:05
Targeted industries: defense-and-aerospace energy-and-utilities government-and-public-sector
Targeted regions: country_code:ir country_code:in country_code:fr country_code:uk country_code:us
Context
Duqu is a malware platform that uses a modular approach to extend functionality after deployment within a target network.
Detection coverage
- 1 YARA rules
- 257 Sigma rules
Malware & tools used
- Keylogging (attack-pattern)
- Archive via Custom Method (attack-pattern)
- Internal Proxy (attack-pattern)
- Msiexec (attack-pattern)
- Local Account (attack-pattern)
- Process Discovery (attack-pattern)
- Valid Accounts (attack-pattern)
- Windows Service (attack-pattern)
- Protocol Tunneling (attack-pattern)
- Local Data Staging (attack-pattern)
- Dynamic-link Library Injection (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Application Layer Protocol (attack-pattern)
- SMB/Windows Admin Shares (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- Access Token Manipulation (attack-pattern)
- Application Window Discovery (attack-pattern)
- Scheduled Task (attack-pattern)
- Steganography (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Process Hollowing (attack-pattern)
- Data from Local System (attack-pattern)
- Data from Information Repositories (attack-pattern)
- Theft of Operational Information (attack-pattern)
Detection rules
- MALPEDIA_Win_Duqu_Auto (yara-rule)
Reports & references
- Kaspersky — The Mystery Of Duqu 2 0 A Sophisticated Cyberespionage Actor Returns (report)
- cocomelonc.github.io — Malware Tricks 45 (report)
- crysys.hu — Ukatemicrysys Territorialdispute (report)
- cocomelonc.github.io — Malware Pers 4 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Duqu (report)
- web.archive.org — 202304114E0Fa0F4Fd1D408Aaddeef8Be63A4757 20230411161526 0531 (report)
- Broadcom/Symantec — W32 Duqu The Precursor To The Next Stuxnet Research (report)
- Broadcom/Symantec — W32 Duqu 11 En (report)
- media.kasperskycontenthub.com — Bartholomew Guerrerosaade Vb2016 (report)
- MITRE ATT&CK — S0038 (report)
- Broadcom/Symantec — W32 Duqu The Precursor To The Next Stuxnet (report)