Symantec reports that Duuzer was active against South Korea, with a particular focus on the manufacturing industry, although the activity was not limited to that region. The backdoor supports remote access, file download, data theft, system and drive enumeration, process control, file modification and deletion, and file timestamp changes. The malware attempts to evade analysis by checking for VirtualBox and VMware environments, and operators were observed manually renaming the malware to resemble installed legitimate software, adding Run-key persistence, mapping the local network, and attempting to disable Symantec Endpoint Protection. Symantec also links the same operators to Brambul and Joanap: Brambul brute-forces SMB with weak credentials and can expose the system drive, while Joanap registers as “SmartCard Protector” and communicates over RC4-encrypted connections to receive backdoor commands.