The Duqu trojan main purpose is to obtain a remote access allowing an adversary to gather information from a compromised computer and of course to download and run arbitrary programs. Duqu malware spotted and identified by experts is based on the same Stuxnet code, however unlike Stuxnet, Duqu does not contain specific code related industrial control systems.
The excellent group CrySyS has located an installer for the malware threat; the installer file is a Microsoft Word document (.doc) that exploits a previously unknown kernel vulnerability that allows code execution. Opening the file a malicious code is able to executes Duqu binaries code.
From Symantec Corp. an interesting article related the malware and the exploit procedure found.
http://www.symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit
From SecureWorks Counter Threat Unit Research Team more info regarding the threat and its features.
The MITRE Corporation revealed that a nation-state actor compromised its systems in January 2024 by…
China-linked threat actors are preparing cyber attacks against U.S. critical infrastructure warned FBI Director Christopher…
The United Nations Development Programme (UNDP) has initiated an investigation into an alleged ransomware attack…
BlackBerry reported that the financially motivated group FIN7 targeted the IT department of a large…
An international law enforcement operation led to the disruption of the prominent phishing-as-a-service platform LabHost.…
Russia-linked APT Sandworm employed a previously undocumented backdoor called Kapeka in attacks against Eastern Europe since…
This website uses cookies.