The Demon Duqu, Brother of Stuxnet

Legend

Discovered in September 2011, it shared much of its code with Stuxnet and gathered information useful for attacking industrial control systems. It arrived in a Word document exploiting a zero-day in TrueType font handling. A later version, Duqu 2.0, spied on Kaspersky itself in 2015.

Exorcism

Cast it out by patching fast and treating unexpected documents with suspicion, even from known senders. Monitoring outbound traffic to unusual destinations helps find it.

Technical record

Also known as: Duqu 2.0
Circle: Circle V · State espionage
First seen: 2011
Status: Dormant

An espionage toolkit discovered in September 2011 that shared much code with Stuxnet and collected information useful for attacking industrial control systems. It was delivered via a Word document exploiting a TrueType font zero-day in the Windows kernel. A memory-only successor, Duqu 2.0, was found inside Kaspersky Lab and at venues of the Iran nuclear negotiations in 2015.

Sources: attack.mitre.org · en.wikipedia.org · MITRE ATT&CK reference S0038