Duqu was discovered on September 1st, 2011 by researchers at the Budapest University of Technology. It is thought to be related to the Stuxnet worm, however rather than targetting industrial control software directly, Duqu offers a more general remote access to infected systems.
One of the interesting facts about Duqu is that Kaspersky Labs turned to the Internet to crowdsource solving the problem of what language a key part of the virus was written in. With more than 200 comments and dozens of emails, the mystery was solved. It turned out to be a custom C extension called "OO C", compiled in Microsoft Visual Studio 2008. This particular combination points to the virus being written by some experienced, old-school programmers.
Few infections have been found in the wild, partially because Duqu is programmed to remove itself after 36 days. Most of those infections were focused on Iran. Some of the servers that Duqu communicates with are still operational, scattered across many countries. A newer version of the virus reappared 4 months after the initial discovery, and the authors of the virus are still unknown.
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
