Meet Duqu, suspected precursor to next-gen Stuxnet cyber attack

Computer security firm Symantec this week identified a one-year old computer malware program called "Duqu" that it believes to have been written by the same authors of the Stuxnet virus that reportedly infected the computer systems controlling Iran's nuclear enrichment program. But the purpose of the Duqu malware is different from that of Stuxnet, Symantec's analysis suggests: it is to "gather intelligence data .... in order to more easily conduct a future attack against another third party."

"We were just utterly shocked when we found this," Stuxnet expert Liam O Murchu told Wired's Kim Zetter.

"On October 14, 2011, a research lab with strong international connections alerted us to a sample that appeared to be very similar to Stuxnet," Symantec wrote on its official blog Tuesday. "They named the threat 'Duqu' [dyü-kyü] because it creates files with the file name prefix '~DQ'."

"Parts of Duqu are nearly identical to Stuxnet, but with a completely different purpose," Symantec wrote. "Duqu is essentially the precursor to a future Stuxnet-like attack. The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered."

So what is Duqu supposed to do? According to Symantec, "to gather intelligence data ... [from] industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility."

"The real surprising thing for us is that these guys"--the creators of Stuxnet--"are still operating,' Stuxnet expert O Murchu told Zetter."We thought these guys would be gone after all the publicity around Stuxnet. That's clearly not the case. They've clearly been operating over the last year. It's quite likely that the information they are gathering is going to be used for a new attack. We were just utterly shocked when we found this."

"Obviously this is a sensitive topic, and for whatever reason, they've decided at this point they don't want to be identified," O Murchu told Zetter, "referring to earlier beliefs about Stuxnet had been created by a nation state with the aim of sabotaging Iran's nuclear program."

Read Zetter's post on Son of Stuxnet, her previous comprehensive report on the "digital detective work that deciphered Stuxnet," and Symantec's Oct. 17/18 analysis of Duqu here.

Other popular Yahoo! News stories:

Atomic swag-ger: Iran chutzpah on display at nuclear conference

French spy chief investigated for spying on journalists

Iran leaders react to U.S. assassination plot claims

Corruption accusations up against U.S. border agents

Want more of our best national security stories? Visit The Envoy or connect with us on Twitter.