H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Duqu](https://attack.mitre.org/software/S0038) is a malware platform that uses a modular approach to extend functionality after deployment within a target network. (Citation: Symantec W32.Duqu)

Labels

malware

21 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to Application Layer Protocol

Technique

uses

to Application Window Discovery

Technique

uses

to Archive via Custom Method

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Internal Proxy

Technique

uses

to Keylogging

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to Msiexec

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Protocol Tunneling

Technique

uses

to Scheduled Task

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Steganography

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to Valid Accounts

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

S0038

open

Symantec W32.Duqu

https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

open