New Version of Flame Malware Platform Discovered

guest · Apr 9, 2019

New Version of Flame Malware Platform Discovered
April 9, 2019
https://www.securityweek.com/new-version-flame-malware-platform-discovered

Connected to Stuxnet and Duqu through the activity cluster tracked by Chronicle as GossipGirl Supra Threat Actor (STA), Flame was first detailed in May 2012, following attacks on several countries, mainly Iran and Israel. The Flame backdoor was found to include worm-like capabilities and is said to have been in use since 2009.

The investigation into GossipGirl, however, led to the discovery of Flame samples that were compiled after 2012, with some builds likely created in February-March 2014, two years after the initial cyberespionage operation was burned down, Chronicle reveals in a report shared with SecurityWeek.

The experts were unable to decode the embedded modules, which prevented them from determining the full functionality of the attack toolkit, but said it was likely designed to support lateral movement, create files, and check for anti-virus programs, among others. Overall, however, the Flame 2.0 platform remains largely a mystery.
Click to expand...

During their analysis of the GossipGirl STA, Chronicle researchers also discovered a new Stuxnet module suggesting that a fourth team was involved in the malware’s development, and Duqu 1.5, which demonstrated that the threat actor behind the malware remained active after its exposure in 2011.
Click to expand...

Chronicle: "Flame 2.0: Risen from the Ashes" (PDF - 530 KB): https://storage.googleapis.com/chronicle-research/Flame%202.0%20Risen%20from%20the%20Ashes.pdf

Log in or Sign up

New Version of Flame Malware Platform Discovered

guest Guest

Log in or Sign up

New Version of Flame Malware Platform Discovered

guest Guest

Useful Searches