Duuzer

Malware updated 15 days ago (2024-11-29T13:33:59.458Z)
Download STIX
Preview STIX
Duuzer is a malicious software (malware) known for its harmful capabilities designed to exploit and damage computers or devices. It was first used in 2015, primarily targeting South Korean organizations, particularly those in the manufacturing sector. The malware, compatible with both 32-bit and 64-bit Windows versions, opens a backdoor in the system, enabling cybercriminals to gather vital system information. Its stealthy infiltration methods include suspicious downloads, emails, or websites, often infecting systems without the user's knowledge. The evolution of Duuzer is evident in the three identified variants of the backdoor: v1.0, v1.1, and v2.0. These versions retain Duuzer's core capabilities and demonstrate an increasing sophistication in their operation. The Lazarus Group, a notorious cybercrime entity, has been linked to these developments, having utilized Duuzer's functionalities in its operations. For example, Rising Sun, a similar implant to Lazarus Group's Duuzer, draws from the same source code. Researchers have confirmed that Rising Sun implants are all based on the original Backdoor Duuzer source code. This connection further solidifies the relationship between the Lazarus Group's activities and the progression of Duuzer malware. Notably, Rising Sun also uses source code from the Duuzer backdoor, exemplifying how the original Duuzer malware has influenced subsequent cyber threats.
Description last updated: 2023-11-29T07:00:55.473Z
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Duuzer Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more