SimplyHosting Coupon

List of Systems & OSes Affected By the Duqu Worm (W32.Duqu)

Which operating systems are at risk for the Duqu worm? Researchers at Symantec have recently discovered a new and dangerous variant of the Stuxnet worm called Duqu. Duqu was first seen in Europe, but is thought to be spreading to the US and Asia. Some portions of the Duqu code base are identical to Stuxnet, but are different in key ways:

Which operating systems and platforms does Duqu affect?

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP.

Some details from Symantec Connect:

Duqu is essentially the precursor to a future Stuxnet-like attack. The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu’s purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility.

Duqu does not contain any code related to industrial control systems and is primarily a remote access Trojan (RAT). The threat does not self-replicate. Our telemetry shows the threat was highly targeted toward a limited number of organizations for their specific assets. However, it’s possible that other attacks are being conducted against other organizations in a similar manner with currently undetected variants.

From Web Host Industry Review:

While some code may be the same, Symantec says Duqu’s purpose is to gather intelligence data and assets from entities like industrial control system manufacturers to conduct a future attack against another third party. It says attackers are looking for information that could help them launch an attack on an industrial control facility. Symantec says the threat was “highly targeted” toward a limited number of organizations for their specific assets.

The first widely exposed variant of Stuxnet was JMINET / NETP191 seen in Europe, and it is likely that in addition to Duqu, additional variants will be found.

More information on Duqu is available on Symantec’s website.