Fifteen years ago this month, reports of a new type of malware — Duqu — were opening the cybersecurity community’s eyes to the possibility of computer virus as tradecraft.
Initially thought to target industrial control systems, Duqu was later discovered to be a new type of spy. Using an innocent-looking but infected Word attachment, Duqu exploited a zero-day vulnerability in Windows to launch a remote access Trojan (RAT). The attachment’s filename included the unwitting recipient’s company name, making the file appear safe.
A deceptive attack hidden in plain sight
The vulnerability involved an embedded TrueType font reportedly called “Dexter Regular” after the Showtime TV show. In another pop culture reference, some emails came from “Mr. B Jason,” a possible nod to fictional spy Jason Bourne. Once the infected file was opened, Duqu would wait to activate until the machine had received no mouse or keyboard input for 10 minutes. Duqu then installed a keylogging program to gather sensitive information on the user’s computer. The malware was programmed to run for 30 to 36 days by default, unless an intervening action extended its lifespan.
Duqu’s design was similar to that of Stuxnet — so similar some called the malware “Son of Stuxnet.” Stuxnet targeted the Iranian nuclear program. The Laboratory of Cryptography and System Security (CrySyS) at the Budapest University of Technology and Economics researched Duqu in great detail, confirming infections in eight countries: France, the Netherlands, Switzerland, Ukraine, India, Iran, Sudan, and Vietnam. In 2015, a new variant called Duqu 2.0 appeared on the scene, targeting countries involved in U.N. Security Council nuclear talks with Iran.
Did you enjoy this installation of SmarterMSP’s Tech Time Warp? Check out others here.
Photo: Teacher Photo / Shutterstock
