What it is
Duqu is a sophisticated espionage malware platform discovered in 2011. Researchers identified technical similarities to Stuxnet, but Duqu was built primarily to collect intelligence rather than directly sabotage industrial equipment. Its operators targeted selected organizations and sought information that could support later operations against industrial environments.
How it works
Duqu used carefully selected infection paths, including a documented zero-day exploit in a malicious Word document. Components installed drivers and backdoors, gathered system and network information, captured data such as keystrokes, and communicated with command infrastructure. Some versions removed themselves after a configured period to reduce forensic traces.
Key points
Duqu describes a targeted espionage toolset, not a common mass-mailing infection.
Historical indicators can support research but should not replace behavior-based detection for related modern activity.
The main risk is stolen design, process, credential, or network information that enables a later intrusion.
What to do
Preserve disk, memory, and network evidence and involve an incident-response team before cleanup.
Review privileged credentials and trust relationships reachable from the affected system.
Segment engineering environments and restrict transfer of sensitive design files.
Patch document-processing software and block unnecessary active content in externally received files.