apt

Duqu (Duqu 2.0)

Attribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Duqu 2.0Tilded team

Attribution

Nation-state — assessed U.S./Israel-linked, Stuxnet-related (circumstantial on sponsor; no MITRE Group ID)

Origin

United States

First seen

2011

Last active

2015

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Iran, regional Middle East

Sectors

Government, industrial/ICS recon, certificate authorities

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Iran, regional Middle East (Government, industrial/ICS recon, certificate authorities sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Rocket KittenactorTechnique overlap
Ferocious KittenactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
Madi / MahdiactorTechnique overlap
Careto / MaskactorTechnique overlap
Flame / FlameractorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap
Cl0pactorTechnique overlap

Sources

01W32.Duqu: The Precursor to the Next Stuxnet — Symantec, 2011-10 ↗02The Mystery of Duqu 2.0: A Sophisticated Cyberespionage Actor Returns — Kaspersky Securelist, 2015-06 ↗srcMENA Threat Actor Tracker reference ↗

Useful?