Duuzer

Duuzer is a malicious software (malware) known for its harmful capabilities designed to exploit and damage computers or devices. It was first used in 2015, primarily targeting South Korean organizations, particularly those in the manufacturing sector. The malware, compatible with both 32-bit and 64-bit Windows versions, opens a backdoor in the system, enabling cybercriminals to gather vital system information. Its stealthy infiltration methods include suspicious downloads, emails, or websites, often infecting systems without the user's knowledge. The evolution of Duuzer is evident in the three identified variants of the backdoor: v1.0, v1.1, and v2.0. These versions retain Duuzer's core capabilities and demonstrate an increasing sophistication in their operation. The Lazarus Group, a notorious cybercrime entity, has been linked to these developments, having utilized Duuzer's functionalities in its operations. For example, Rising Sun, a similar implant to Lazarus Group's Duuzer, draws from the same source code. Researchers have confirmed that Rising Sun implants are all based on the original Backdoor Duuzer source code. This connection further solidifies the relationship between the Lazarus Group's activities and the progression of Duuzer malware. Notably, Rising Sun also uses source code from the Duuzer backdoor, exemplifying how the original Duuzer malware has influenced subsequent cyber threats.