Knowledge (XXG)

Duqu

Source 📝

222:. Its purpose is not to be destructive; the known components are trying to gather information. However, based on the modular structure of Duqu, special payload could be used to attack any type of computer system by any means and thus cyber-physical attacks based on Duqu might be possible. However, use of personal computer systems has been found to delete all recent information entered on the system, and in some cases total deletion of the computer's hard drive. Internal communications of Duqu are analysed by Symantec, but the actual and exact method how it replicates inside an attacked network is not yet fully known. According to 125:, based on the CrySyS team managed by Dr Thibault Gainche report, continued the analysis of the threat, which it called "nearly identical to Stuxnet, but with a completely different purpose", and published a detailed technical paper on it with a cut-down version of the original lab report as an appendix. Symantec believes that Duqu was created by the same authors as 234:
file and encrypted dummy files as containers to smuggle data to its command and control center. Security experts are still analyzing the code to determine what information the communications contain. Initial research indicates that the original malware sample automatically removes itself after 36
80:
is a variety of software components that together provide services to the attackers. Currently this includes information stealing capabilities and in the background, kernel drivers and injection tools. Part of this malware is written in unknown high-level programming language, dubbed "Duqu
534: 210:, which is a TrueType font parsing engine if the patch released by Microsoft in December 2011 is not yet installed. Microsoft identifier for the threat is MS11-087 (first advisory issued on 13 November 2011). 780: 1191: 1211: 65:
discovered the threat, analysed the malware, and wrote a 60-page report naming the threat Duqu. Duqu got its name from the prefix "~DQ" it gives to the names of files it creates.
149:
that F-Secure's back-end system thought it was Stuxnet. Hyppönen further said that the key used to make Duqu's own digital signature (only observed in one case) was stolen from
838: 677: 423:
Jeffrey Carr, Principal consultant at 20KLeague.com; Founder of Suits and Spooks; Author of “Inside Cyber Warfare (O’Reilly Media, 2009, 2011), medium.com, Aug 25, 2016
545: 58: 877: 416: 1363: 903: 1181: 1125: 655: 251:
The executables have been found in a limited number of organizations, including those involved in the manufacturing of industrial control systems.
788: 160:, reports that Duqu may not be related to Stuxnet. However, there is considerable and growing evidence that Duqu is closely related to Stuxnet. 2381: 2351: 1171: 940: 444: 254:
The exfiltrated data may be used to enable a future Stuxnet-like attack, or might already have been used as the basis for the Stuxnet attack.
153:, located in Taipei, Taiwan. The certificates were due to expire on 2 August 2012 but were revoked on 14 October 2011 according to Symantec. 1295: 569: 206:
parsing engine and allows execution. The Duqu dropper relates to font embedding, and thus relates to the workaround to restrict access to
81:
framework". It is not C++, Python, Ada, Lua and many other checked languages. However, it is suggested that Duqu may have been written in
757: 1709: 1176: 99:
is the flaw in Microsoft Windows that is used in malicious files to execute malware components of Duqu. Currently one flaw is known, a
1843: 1825: 1326: 1104: 870: 334: 830: 1849: 1375: 1336: 971: 319: 1150: 1909: 1855: 1430: 1321: 1257: 1094: 996: 687: 2356: 1316: 1089: 451:
Foreign sources routinely assert that Unit 8200 contribured to Stuxnet, Flame, Duqu and other sophisticated cyber campaigns.
2386: 2376: 1196: 908: 898: 863: 398: 2361: 2070: 1460: 1247: 1186: 1145: 1043: 90: 434: 413: 1565: 1300: 1063: 374: 86: 2371: 2254: 1595: 1450: 1242: 1135: 1079: 264: 219: 1735: 1704: 1331: 501: 129:, or that the authors had access to the source code of Stuxnet. The worm, like Stuxnet, has a valid, but abused 1873: 1440: 1358: 1264: 1237: 314: 82: 309: 582: 2029: 1693: 1166: 1099: 945: 359: 227: 1903: 1759: 1590: 1252: 195: 50: 113:
is the process of only using Duqu for unknown goals. The operation might be related to Operation Stuxnet.
2366: 2044: 1879: 1663: 1027: 627: 602: 349: 1807: 1688: 1400: 1109: 1058: 1053: 765: 226:, one of Duqu's actions is to steal digital certificates (and corresponding private keys, as used in 248:
Current analysis shows no code related to industrial control systems, exploits, or self-replication.
230:) from attacked computers to help future viruses appear as secure software. Duqu uses a 54×54 pixel 2306: 2178: 1206: 1022: 2316: 2311: 2208: 1837: 1600: 1526: 1216: 1017: 735: 709: 484: 235:
days (the malware stores this setting in configuration files), which would limit its detection.
267:
of Duqu have been analysed. It seems that the people running the attack had a predilection for
2346: 2321: 2203: 2173: 1777: 1633: 991: 955: 440: 245:
The executables are designed to capture information such as keystrokes and system information.
191: 134: 130: 46: 2249: 2101: 2024: 1673: 1610: 1485: 934: 354: 272: 242:
Executables developed after Stuxnet using the Stuxnet source code that have been discovered.
198:. The first-known installer (AKA dropper) file recovered and disclosed by CrySyS Lab uses a 157: 2259: 2234: 2198: 2126: 2039: 2034: 1678: 1470: 1380: 1084: 504:. Laboratory of Cryptography of Systems Security (CrySyS). 21 October 2011. Archived from 420: 339: 329: 168: 1998: 1993: 1683: 1668: 1658: 1653: 1585: 1560: 1555: 1550: 1495: 950: 541: 344: 199: 122: 34: 2340: 2121: 1580: 1539: 1535: 1531: 761: 296: 203: 177:
Duqu and Stuxnet are both highly targeted and related to the nuclear program of Iran.
2065: 2019: 1819: 1783: 1638: 1628: 1521: 1516: 1511: 1385: 1201: 1130: 2301: 2291: 2239: 2147: 2091: 2003: 1952: 1813: 1643: 1370: 1001: 364: 324: 284: 2244: 2229: 2157: 1947: 1897: 1801: 1753: 1729: 1717: 1575: 1500: 1490: 1480: 1465: 1425: 1350: 981: 369: 54: 2275: 2152: 2116: 2106: 1978: 1795: 1545: 1475: 1415: 976: 379: 42: 490:. Laboratory of Cryptography of Systems Security (CrySyS). 14 October 2011. 2183: 2111: 2096: 1915: 1891: 1765: 1747: 1648: 1570: 1405: 1390: 1290: 1269: 1048: 781:"The Day of the Golden Jackal – The Next Tale in the Stuxnet Files: Duqu" 714:
Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege
632: 505: 138: 100: 20: 2213: 2086: 2049: 1983: 1962: 1932: 1885: 1867: 1789: 1723: 1505: 1420: 1410: 1395: 855: 280: 276: 187: 150: 126: 62: 38: 30: 275:
for it. Servers are scattered in many different countries, including
163:
Experts compared the similarities and found three points of interest:
2296: 2188: 2142: 1957: 1771: 1741: 1620: 1605: 1435: 1274: 986: 784: 399:
How Israel Caught Russian Hackers Scouring the World for U.S. Secrets
299:
has published multiple blogposts on the command and control servers.
268: 223: 656:"Spotted in Iran, trojan Duqu may not be "son of Stuxnet" after all" 1921: 1861: 1831: 1140: 682: 485:"Duqu: A Stuxnet-like malware found in the wild, technical report" 292: 288: 831:"The Mystery of Duqu: Part Six (The Command and Control servers)" 271:
5.x servers, leading some researchers to believe that they had a
2193: 1232: 572:
Duqu Trojan contains mystery programming language in Payload DLL
231: 859: 811: 218:
Duqu looks for information that could be useful in attacking
535:"W32.Duqu – The precursor to the next Stuxnet (Version 1.4)" 583:"Securelist | Kaspersky's threat research and reports" 756:
Steven Cherry, with Larry Constantine (14 December 2011).
133:, and collects information to prepare for future attacks. 1172:
Hollywood Presbyterian Medical Center ransomware incident
464:"Laboratory of Cryptography and System Security (CrySyS)" 463: 678:"Microsoft issues temporary 'fix-it' for Duqu zero-day" 603:"Son of Stuxnet Found in the Wild on Systems in Europe" 53:. The Laboratory of Cryptography and System Security ( 2284: 2268: 2222: 2166: 2135: 2079: 2058: 2012: 1971: 1940: 1931: 1702: 1619: 1449: 1349: 1309: 1283: 1225: 1159: 1118: 1072: 1036: 1010: 964: 927: 920: 779:Venere, Guilherme; Szor, Peter (18 October 2011). 19:For the version of malware announced in 2015, see 736:"Microsoft Security Bulletin MS11-087 - Critical" 596: 594: 592: 16:Collection of computer malware discovered in 2011 1212:Russian interference in the 2016 U.S. elections 529: 527: 525: 523: 174:Components are signed with stolen digital keys. 59:Budapest University of Technology and Economics 871: 628:"Virus Duqu alarmiert IT-Sicherheitsexperten" 8: 73:The term Duqu is used in a variety of ways: 1182:Democratic National Committee cyber attacks 33:discovered on 1 September 2011, thought by 1937: 1126:Office of Personnel Management data breach 924: 878: 864: 856: 414:NSA, Unit 8200, and Malware Proliferation 710:"Microsoft Security Advisory (2639658)" 391: 502:"Statement on Duqu's initial analysis" 436:The Oxford Handbook of Cyber Security 7: 1177:Commission on Elections data breach 829:Kamluk, Vitaly (30 November 2011). 202:document that exploits the Win32k 544:. 23 November 2011. Archived from 335:List of cyber attack threat trends 141:, said that Duqu's kernel driver, 14: 1337:Jeff Bezos phone hacking incident 812:"In Command & Out of Control" 433:Cornish, Paul (4 November 2021). 320:Cyberwarfare in the United States 41:worm and to have been created by 1910:Microarchitectural Data Sampling 1146:Ukrainian Power Grid Cyberattack 1054:Cyberterrorism attack of June 25 841:from the original on 7 June 2022 1258:2017 Ukraine ransomware attacks 1095:2014 JPMorgan Chase data breach 601:Zetter, Kim (18 October 2011). 182:Microsoft Word zero-day exploit 171:Windows kernel vulnerabilities. 1090:2014 celebrity nude photo leak 145:, was so similar to Stuxnet's 1: 2382:Cyberattacks on energy sector 2352:Privilege escalation exploits 1327:Bulgarian revenue agency hack 1105:Russian hacker password theft 137:, Chief Research Officer for 1461:Bangladesh Black Hat Hackers 937:(publication of 2009 events) 91:Microsoft Visual Studio 2008 29:is a collection of computer 1322:Baltimore ransomware attack 439:. Oxford University Press. 375:United States Cyber Command 265:command and control servers 259:Command and control servers 2403: 1596:Tailored Access Operations 1243:WannaCry ransomware attack 1136:Ashley Madison data breach 1080:Anthem medical data breach 997:PlayStation network outage 220:industrial control systems 89:framework and compiled in 18: 1332:WhatsApp snooping scandal 1197:Indian Bank data breaches 891: 103:-font related problem in 1874:Speculative Store Bypass 1441:Ukrainian Cyber Alliance 1238:2017 Macron e-mail leaks 315:Cyber security standards 310:Cyber electronic warfare 1248:Westminster data breach 1167:Bangladesh Bank robbery 1110:2014 Yahoo! data breach 1100:2014 Sony Pictures hack 1059:2013 Yahoo! data breach 1044:South Korea cyberattack 946:Operation Olympic Games 941:Australian cyberattacks 835:Securelist by Kaspersky 419:25 October 2017 at the 360:Proactive Cyber Defence 228:public-key cryptography 167:The installer exploits 118:Relationship to Stuxnet 1591:Syrian Electronic Army 1301:SingHealth data breach 1064:Singapore cyberattacks 1002:RSA SecurID compromise 196:zero-day vulnerability 51:zero-day vulnerability 2357:Cryptographic attacks 1880:Lazy FP state restore 1664:Kristoffer von Hassel 1317:Sri Lanka cyberattack 1187:Vietnam Airport Hacks 1028:Operation High Roller 350:Operation High Roller 45:. Duqu has exploited 37:to be related to the 2387:Hacking in the 2010s 2377:Cyberwarfare in Iran 1826:Silent Bob is Silent 886:Hacking in the 2010s 585:. 12 September 2023. 2362:Exploit-based worms 1760:SS7 vulnerabilities 1296:Atlanta cyberattack 1265:Equifax data breach 1023:Stratfor email leak 972:Canadian government 951:Operation ShadowNet 570:Shawn Knight (2012) 551:on 13 December 2011 2209:Petya and NotPetya 1838:ROCA vulnerability 1601:The Shadow Brokers 1527:Iranian Cyber Army 1453:persistent threats 1253:Petya and NotPetya 1217:2016 Bitfinex hack 1192:DCCC cyber attacks 1151:SWIFT banking hack 690:on 6 November 2011 2372:2011 in computing 2334: 2333: 2330: 2329: 2322:ZeroAccess botnet 1634:Mustafa Al-Bassam 1401:New World Hackers 1364:associated events 1345: 1344: 1141:VTech data breach 992:Operation AntiSec 956:Operation Payback 915: 914: 810:Garmon, Matthew. 758:"Sons of Stuxnet" 716:. 3 November 2011 658:. 27 October 2011 636:. 19 October 2011 508:on 4 October 2012 446:978-0-19-252101-9 192:Microsoft Windows 131:digital signature 47:Microsoft Windows 2394: 1938: 1611:Yemen Cyber Army 935:Operation Aurora 925: 894: 893: 880: 873: 866: 857: 851: 850: 848: 846: 826: 820: 819: 807: 801: 800: 798: 796: 787:. Archived from 776: 770: 769: 768:on 19 July 2012. 764:. Archived from 753: 747: 746: 744: 742: 732: 726: 725: 723: 721: 706: 700: 699: 697: 695: 686:. Archived from 674: 668: 667: 665: 663: 652: 646: 645: 643: 641: 624: 618: 617: 615: 613: 598: 587: 586: 579: 573: 567: 561: 560: 558: 556: 550: 539: 531: 518: 517: 515: 513: 498: 492: 491: 489: 481: 475: 474: 472: 470: 460: 454: 453: 430: 424: 411: 405: 396: 355:Operation Merlin 273:zero-day exploit 238:Key points are: 209: 194:systems using a 158:Dell SecureWorks 156:Another source, 148: 144: 106: 2402: 2401: 2397: 2396: 2395: 2393: 2392: 2391: 2337: 2336: 2335: 2326: 2280: 2264: 2218: 2162: 2131: 2075: 2054: 2008: 1967: 1927: 1707: 1705:vulnerabilities 1698: 1615: 1508:(confederation) 1471:Charming Kitten 1452: 1445: 1381:Goatse Security 1341: 1305: 1279: 1270:Deloitte breach 1221: 1207:Dyn cyberattack 1155: 1114: 1085:Operation Tovar 1068: 1032: 1006: 960: 921:Major incidents 916: 887: 884: 854: 844: 842: 828: 827: 823: 809: 808: 804: 794: 792: 778: 777: 773: 755: 754: 750: 740: 738: 734: 733: 729: 719: 717: 708: 707: 703: 693: 691: 676: 675: 671: 661: 659: 654: 653: 649: 639: 637: 626: 625: 621: 611: 609: 600: 599: 590: 581: 580: 576: 568: 564: 554: 552: 548: 537: 533: 532: 521: 511: 509: 500: 499: 495: 487: 483: 482: 478: 468: 466: 462: 461: 457: 447: 432: 431: 427: 421:Wayback Machine 412: 408: 397: 393: 389: 384: 340:Mahdi (malware) 330:Flame (malware) 305: 261: 216: 207: 190:, Duqu attacks 184: 146: 142: 120: 104: 87:object oriented 71: 24: 17: 12: 11: 5: 2400: 2398: 2390: 2389: 2384: 2379: 2374: 2369: 2364: 2359: 2354: 2349: 2339: 2338: 2332: 2331: 2328: 2327: 2325: 2324: 2319: 2314: 2309: 2304: 2299: 2294: 2288: 2286: 2282: 2281: 2279: 2278: 2272: 2270: 2266: 2265: 2263: 2262: 2257: 2252: 2247: 2242: 2237: 2232: 2226: 2224: 2220: 2219: 2217: 2216: 2211: 2206: 2201: 2196: 2191: 2186: 2181: 2176: 2170: 2168: 2164: 2163: 2161: 2160: 2155: 2150: 2145: 2139: 2137: 2133: 2132: 2130: 2129: 2124: 2119: 2114: 2109: 2104: 2099: 2094: 2092:Black Energy 3 2089: 2083: 2081: 2077: 2076: 2074: 2073: 2068: 2062: 2060: 2056: 2055: 2053: 2052: 2047: 2042: 2037: 2032: 2027: 2022: 2016: 2014: 2010: 2009: 2007: 2006: 2001: 1999:Metulji botnet 1996: 1991: 1986: 1981: 1975: 1973: 1969: 1968: 1966: 1965: 1960: 1955: 1953:Black Energy 2 1950: 1944: 1942: 1935: 1929: 1928: 1926: 1925: 1919: 1913: 1907: 1901: 1895: 1889: 1883: 1877: 1871: 1865: 1859: 1853: 1847: 1841: 1835: 1829: 1823: 1817: 1811: 1808:Broadcom Wi-Fi 1805: 1799: 1793: 1787: 1781: 1775: 1769: 1763: 1757: 1751: 1745: 1739: 1733: 1727: 1721: 1714: 1712: 1700: 1699: 1697: 1696: 1691: 1686: 1681: 1676: 1671: 1669:Junaid Hussain 1666: 1661: 1659:Jeremy Hammond 1656: 1654:Elliott Gunton 1651: 1646: 1641: 1636: 1631: 1625: 1623: 1617: 1616: 1614: 1613: 1608: 1603: 1598: 1593: 1588: 1586:Stealth Falcon 1583: 1578: 1573: 1568: 1563: 1561:PLA Unit 61486 1558: 1556:PLA Unit 61398 1553: 1551:Numbered Panda 1548: 1543: 1529: 1524: 1519: 1514: 1509: 1503: 1498: 1496:Equation Group 1493: 1488: 1483: 1478: 1473: 1468: 1463: 1457: 1455: 1447: 1446: 1444: 1443: 1438: 1433: 1428: 1423: 1418: 1413: 1408: 1403: 1398: 1393: 1388: 1383: 1378: 1373: 1368: 1367: 1366: 1355: 1353: 1347: 1346: 1343: 1342: 1340: 1339: 1334: 1329: 1324: 1319: 1313: 1311: 1307: 1306: 1304: 1303: 1298: 1293: 1287: 1285: 1281: 1280: 1278: 1277: 1272: 1267: 1262: 1261: 1260: 1250: 1245: 1240: 1235: 1229: 1227: 1223: 1222: 1220: 1219: 1214: 1209: 1204: 1199: 1194: 1189: 1184: 1179: 1174: 1169: 1163: 1161: 1157: 1156: 1154: 1153: 1148: 1143: 1138: 1133: 1128: 1122: 1120: 1116: 1115: 1113: 1112: 1107: 1102: 1097: 1092: 1087: 1082: 1076: 1074: 1070: 1069: 1067: 1066: 1061: 1056: 1051: 1046: 1040: 1038: 1034: 1033: 1031: 1030: 1025: 1020: 1014: 1012: 1008: 1007: 1005: 1004: 999: 994: 989: 987:HBGary Federal 984: 979: 974: 968: 966: 962: 961: 959: 958: 953: 948: 943: 938: 931: 929: 922: 918: 917: 913: 912: 906: 901: 892: 889: 888: 885: 883: 882: 875: 868: 860: 853: 852: 821: 802: 791:on 31 May 2016 771: 748: 727: 701: 669: 647: 619: 588: 574: 562: 519: 493: 476: 455: 445: 425: 406: 403:New York Times 390: 388: 385: 383: 382: 377: 372: 367: 362: 357: 352: 347: 345:Moonlight Maze 342: 337: 332: 327: 322: 317: 312: 306: 304: 301: 260: 257: 256: 255: 252: 249: 246: 243: 215: 212: 200:Microsoft Word 183: 180: 179: 178: 175: 172: 135:Mikko Hyppönen 119: 116: 115: 114: 111:Operation Duqu 108: 94: 85:with a custom 70: 67: 35:Kaspersky Labs 15: 13: 10: 9: 6: 4: 3: 2: 2399: 2388: 2385: 2383: 2380: 2378: 2375: 2373: 2370: 2368: 2365: 2363: 2360: 2358: 2355: 2353: 2350: 2348: 2345: 2344: 2342: 2323: 2320: 2318: 2315: 2313: 2310: 2308: 2305: 2303: 2300: 2298: 2295: 2293: 2290: 2289: 2287: 2283: 2277: 2274: 2273: 2271: 2267: 2261: 2258: 2256: 2253: 2251: 2248: 2246: 2243: 2241: 2238: 2236: 2233: 2231: 2228: 2227: 2225: 2221: 2215: 2212: 2210: 2207: 2205: 2202: 2200: 2197: 2195: 2192: 2190: 2187: 2185: 2182: 2180: 2177: 2175: 2172: 2171: 2169: 2165: 2159: 2156: 2154: 2151: 2149: 2146: 2144: 2141: 2140: 2138: 2134: 2128: 2125: 2123: 2122:Gameover ZeuS 2120: 2118: 2115: 2113: 2110: 2108: 2105: 2103: 2100: 2098: 2095: 2093: 2090: 2088: 2085: 2084: 2082: 2078: 2072: 2069: 2067: 2064: 2063: 2061: 2057: 2051: 2048: 2046: 2043: 2041: 2038: 2036: 2033: 2031: 2028: 2026: 2023: 2021: 2018: 2017: 2015: 2011: 2005: 2002: 2000: 1997: 1995: 1992: 1990: 1987: 1985: 1982: 1980: 1977: 1976: 1974: 1970: 1964: 1961: 1959: 1956: 1954: 1951: 1949: 1946: 1945: 1943: 1939: 1936: 1934: 1930: 1923: 1920: 1917: 1914: 1911: 1908: 1905: 1902: 1899: 1896: 1893: 1890: 1887: 1884: 1881: 1878: 1875: 1872: 1869: 1866: 1863: 1860: 1857: 1854: 1851: 1848: 1845: 1842: 1839: 1836: 1833: 1830: 1827: 1824: 1821: 1818: 1815: 1812: 1809: 1806: 1803: 1800: 1797: 1794: 1791: 1788: 1785: 1782: 1779: 1776: 1773: 1770: 1767: 1764: 1761: 1758: 1755: 1752: 1749: 1746: 1743: 1740: 1737: 1734: 1731: 1728: 1725: 1722: 1719: 1716: 1715: 1713: 1711: 1706: 1701: 1695: 1692: 1690: 1687: 1685: 1682: 1680: 1677: 1675: 1672: 1670: 1667: 1665: 1662: 1660: 1657: 1655: 1652: 1650: 1647: 1645: 1642: 1640: 1637: 1635: 1632: 1630: 1627: 1626: 1624: 1622: 1618: 1612: 1609: 1607: 1604: 1602: 1599: 1597: 1594: 1592: 1589: 1587: 1584: 1582: 1581:Rocket Kitten 1579: 1577: 1574: 1572: 1569: 1567: 1564: 1562: 1559: 1557: 1554: 1552: 1549: 1547: 1544: 1541: 1537: 1533: 1532:Lazarus Group 1530: 1528: 1525: 1523: 1520: 1518: 1515: 1513: 1510: 1507: 1504: 1502: 1499: 1497: 1494: 1492: 1489: 1487: 1484: 1482: 1479: 1477: 1474: 1472: 1469: 1467: 1464: 1462: 1459: 1458: 1456: 1454: 1448: 1442: 1439: 1437: 1434: 1432: 1429: 1427: 1424: 1422: 1419: 1417: 1414: 1412: 1409: 1407: 1404: 1402: 1399: 1397: 1394: 1392: 1389: 1387: 1384: 1382: 1379: 1377: 1374: 1372: 1369: 1365: 1362: 1361: 1360: 1357: 1356: 1354: 1352: 1348: 1338: 1335: 1333: 1330: 1328: 1325: 1323: 1320: 1318: 1315: 1314: 1312: 1308: 1302: 1299: 1297: 1294: 1292: 1289: 1288: 1286: 1282: 1276: 1275:Disqus breach 1273: 1271: 1268: 1266: 1263: 1259: 1256: 1255: 1254: 1251: 1249: 1246: 1244: 1241: 1239: 1236: 1234: 1231: 1230: 1228: 1224: 1218: 1215: 1213: 1210: 1208: 1205: 1203: 1200: 1198: 1195: 1193: 1190: 1188: 1185: 1183: 1180: 1178: 1175: 1173: 1170: 1168: 1165: 1164: 1162: 1158: 1152: 1149: 1147: 1144: 1142: 1139: 1137: 1134: 1132: 1129: 1127: 1124: 1123: 1121: 1117: 1111: 1108: 1106: 1103: 1101: 1098: 1096: 1093: 1091: 1088: 1086: 1083: 1081: 1078: 1077: 1075: 1071: 1065: 1062: 1060: 1057: 1055: 1052: 1050: 1049:Snapchat hack 1047: 1045: 1042: 1041: 1039: 1035: 1029: 1026: 1024: 1021: 1019: 1018:LinkedIn hack 1016: 1015: 1013: 1009: 1003: 1000: 998: 995: 993: 990: 988: 985: 983: 980: 978: 975: 973: 970: 969: 967: 963: 957: 954: 952: 949: 947: 944: 942: 939: 936: 933: 932: 930: 926: 923: 919: 911: → 910: 907: 905: 902: 900: 897:←  896: 895: 890: 881: 876: 874: 869: 867: 862: 861: 858: 840: 836: 832: 825: 822: 817: 813: 806: 803: 790: 786: 782: 775: 772: 767: 763: 762:IEEE Spectrum 759: 752: 749: 737: 731: 728: 715: 711: 705: 702: 689: 685: 684: 679: 673: 670: 657: 651: 648: 635: 634: 629: 623: 620: 608: 604: 597: 595: 593: 589: 584: 578: 575: 571: 566: 563: 547: 543: 536: 530: 528: 526: 524: 520: 507: 503: 497: 494: 486: 480: 477: 465: 459: 456: 452: 448: 442: 438: 437: 429: 426: 422: 418: 415: 410: 407: 404: 400: 395: 392: 386: 381: 378: 376: 373: 371: 368: 366: 363: 361: 358: 356: 353: 351: 348: 346: 343: 341: 338: 336: 333: 331: 328: 326: 323: 321: 318: 316: 313: 311: 308: 307: 302: 300: 298: 294: 290: 286: 282: 278: 274: 270: 266: 258: 253: 250: 247: 244: 241: 240: 239: 236: 233: 229: 225: 221: 213: 211: 205: 204:TrueType font 201: 197: 193: 189: 181: 176: 173: 170: 166: 165: 164: 161: 159: 154: 152: 140: 136: 132: 128: 124: 117: 112: 109: 102: 98: 95: 92: 88: 84: 79: 76: 75: 74: 68: 66: 64: 60: 56: 52: 48: 44: 40: 36: 32: 28: 22: 2367:Cyberwarfare 2066:CryptoLocker 1988: 1820:DoublePulsar 1639:Cyber Anakin 1629:Ryan Ackroyd 1522:Helix Kitten 1517:Hacking Team 1512:Guccifer 2.0 1386:Lizard Squad 1202:Surkov leaks 1131:Hacking Team 843:. Retrieved 834: 824: 815: 805: 793:. Retrieved 789:the original 774: 766:the original 751: 739:. Retrieved 730: 718:. Retrieved 713: 704: 692:. Retrieved 688:the original 681: 672: 660:. Retrieved 650: 638:. Retrieved 631: 622: 610:. Retrieved 606: 577: 565: 553:. Retrieved 546:the original 510:. Retrieved 506:the original 496: 479: 467:. Retrieved 458: 450: 435: 428: 409: 402: 394: 263:Some of the 262: 237: 217: 185: 162: 155: 121: 110: 96: 78:Duqu malware 77: 72: 69:Nomenclature 26: 25: 2302:NetTraveler 2240:LogicLocker 2148:Hidden Tear 2045:Red October 1904:Dragonblood 1814:EternalBlue 1778:Stagefright 1644:George Hotz 1621:Individuals 1371:CyberBerkut 816:Matt Garmon 741:13 November 555:30 December 365:Stars virus 325:Cyberweapon 285:Philippines 208:T2EMBED.DLL 143:JMINET7.SYS 2341:Categories 2245:Rensenware 2230:BrickerBot 2158:TeslaCrypt 1948:Bad Rabbit 1898:Foreshadow 1802:Cloudbleed 1754:Row hammer 1736:Shellshock 1730:Heartbleed 1718:Evercookie 1694:The Jester 1576:Red Apollo 1536:BlueNorOff 1506:GOSSIPGIRL 1501:Fancy Bear 1491:Elfin Team 1486:DarkMatter 1481:Dark Basin 1466:Bureau 121 1426:Teamp0ison 1351:Hacktivism 982:DNSChanger 795:19 October 720:5 November 694:5 November 662:27 October 640:19 October 612:21 October 512:25 October 469:4 November 387:References 370:Titan Rain 147:MRXCLS.SYS 105:win32k.sys 55:CrySyS Lab 2276:VPNFilter 2153:Rombertik 2117:FinFisher 2107:DarkHotel 2071:DarkSeoul 1979:Coreflood 1844:BlueBorne 1796:Dirty COW 1710:disclosed 1708:publicly 1546:NSO Group 1476:Cozy Bear 1416:PayPal 14 1359:Anonymous 1233:SHAttered 977:DigiNotar 380:Unit 8200 297:Kaspersky 97:Duqu flaw 57:) of the 43:Unit 8200 2347:Rootkits 2317:Titanium 2260:XafeCopy 2255:WannaCry 2184:KeRanger 2112:Duqu 2.0 2097:Carbanak 1916:BlueKeep 1892:SigSpoof 1850:Meltdown 1766:WinShock 1748:Rootpipe 1649:Guccifer 1571:Pranknet 1566:PLATINUM 1540:AndAriel 1451:Advanced 1406:NullCrew 1391:LulzRaft 1291:Trustico 904:Timeline 839:Archived 633:Die Zeit 542:Symantec 417:Archived 303:See also 169:zero-day 139:F-Secure 123:Symantec 101:TrueType 21:Duqu 2.0 2214:X-Agent 2204:Pegasus 2087:Brambul 2050:Shamoon 1994:Kelihos 1984:Alureon 1963:Stuxnet 1933:Malware 1886:TLBleed 1868:Exactis 1856:Spectre 1790:Badlock 1724:iSeeYou 1689:Topiary 1421:RedHack 1411:OurMine 1396:LulzSec 281:Belgium 277:Germany 214:Purpose 188:Stuxnet 151:C-Media 127:Stuxnet 63:Hungary 39:Stuxnet 31:malware 2297:Joanap 2250:Triton 2189:Necurs 2179:Jigsaw 2174:Hitler 2143:Dridex 2102:Careto 2025:Dexter 1958:SpyEye 1924:(2019) 1918:(2019) 1912:(2019) 1906:(2019) 1900:(2018) 1894:(2018) 1888:(2018) 1882:(2018) 1876:(2018) 1870:(2018) 1864:(2018) 1858:(2018) 1852:(2018) 1846:(2017) 1840:(2017) 1834:(2017) 1828:(2017) 1822:(2017) 1816:(2017) 1810:(2017) 1804:(2017) 1798:(2016) 1792:(2016) 1786:(2016) 1780:(2015) 1774:(2015) 1772:JASBUG 1768:(2014) 1762:(2014) 1756:(2014) 1750:(2014) 1744:(2014) 1742:POODLE 1738:(2014) 1732:(2014) 1726:(2013) 1720:(2010) 1703:Major 1684:Track2 1606:xDedic 1436:UGNazi 845:7 June 818:. DIG. 785:McAfee 443:  269:CentOS 224:McAfee 2312:Tinba 2199:Mirai 2127:Regin 2040:Mahdi 2035:Flame 2020:Carna 2004:Stars 1922:Kr00k 1862:EFAIL 1832:KRACK 1784:DROWN 909:2020s 899:2000s 683:ZDNet 607:Wired 549:(PDF) 538:(PDF) 488:(PDF) 293:China 289:India 186:Like 2307:R2D2 2292:Grum 2285:2019 2269:2018 2235:Kirk 2223:2017 2194:MEMZ 2167:2016 2136:2015 2080:2014 2059:2013 2013:2012 1989:Duqu 1972:2011 1941:2010 1679:Sabu 1431:TDO 1376:GNAA 1310:2019 1284:2018 1226:2017 1160:2016 1119:2015 1073:2014 1037:2013 1011:2012 965:2011 928:2010 847:2022 797:2011 743:2011 722:2011 696:2011 664:2011 642:2011 614:2011 557:2011 514:2011 471:2011 441:ISBN 291:and 232:JPEG 27:Duqu 2030:FBI 1674:MLT 1538:) ( 61:in 49:'s 2343:: 837:. 833:. 814:. 783:. 760:. 712:. 680:. 630:. 605:. 591:^ 540:. 522:^ 449:. 401:, 295:. 287:, 283:, 279:, 1542:) 1534:( 879:e 872:t 865:v 849:. 799:. 745:. 724:. 698:. 666:. 644:. 616:. 559:. 516:. 473:. 107:. 93:. 83:C 23:.

Index

Duqu 2.0
malware
Kaspersky Labs
Stuxnet
Unit 8200
Microsoft Windows
zero-day vulnerability
CrySyS Lab
Budapest University of Technology and Economics
Hungary
C
object oriented
Microsoft Visual Studio 2008
TrueType
Symantec
Stuxnet
digital signature
Mikko Hyppönen
F-Secure
C-Media
Dell SecureWorks
zero-day
Stuxnet
Microsoft Windows
zero-day vulnerability
Microsoft Word
TrueType font
industrial control systems
McAfee
public-key cryptography

Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.