Unit 8200

Also reported as Duqu Group. Linked to Israel by two sources.

Reports: 8
Last reported: 6 April 2026
Known CVEs: 5
Origin: Israel

ID: unit-8200
Sources: MISP Malpedia
Merge evidence: 2 alias matches

Reports per quarter

2015 Q2: 2 reports
2015 Q3: no reports
2015 Q4: no reports
2016 Q1: no reports
2016 Q2: no reports
2016 Q3: no reports
2016 Q4: no reports
2017 Q1: no reports
2017 Q2: no reports
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: 1 report
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: 1 report
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: 1 report
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: 1 report
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: 1 report
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 1 report

Dated reports, 2015 Q2 to 2026 Q2.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Duqu

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Duqu
24 February 2025

Malware development trick 45: hiding and extracting payload in PNGs (with cats). Simple C example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development trick 45: hiding and extracting payload in PNGs (with cats). Simple C example.
11 April 2023

202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor 202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf
9 May 2022

Malware development: persistence - part 4. Windows services. Simple C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 4. Windows services. Simple C++ example.
6 May 2021

Iran Cyber Operations Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Iran Cyber Operations Groups
1 March 2018

Territorial Dispute - NSA's perspective on APT landscape

date in the CCS '25 data CrySyS Lab fromCCS '25 data

Detailsfor Territorial Dispute - NSA's perspective on APT landscape
10 June 2015

The Mystery of Duqu 2.0: a sophisticated cyberespionage actor returns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Mystery of Duqu 2.0: a sophisticated cyberespionage actor returns
10 June 2015

The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns

date in the CCS '25 data Kaspersky fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor The_Mystery_of_Duqu_2_0_a_sophisticated_cyberespionage_actor_returns

Newest first. Details opens the report in Explore.