Loading malware…
Gauss is malware linked by code similarity and broader ecosystem analysis to the same development group behind Flame and MiniFlame, and is also described in the content as one of the malware families spawned by the same software developers as Stuxnet. It is referenced as a more widespread successor to, or possible side operation alongside, Flame/MiniFlame. The content places Gauss within a cluster of advanced state-linked cyberespionage platforms associated with the broader Flame-Stuxnet-Duqu ecosystem and retrospective research into the GOSSIPGIRL or “supra threat actor” umbrella. Researchers traced relationships from Flame to MiniFlame and Gauss, and generic detections from Flame reportedly helped uncover Gauss as related malware from the same group. The content does not provide a full standalone capability profile for Gauss, but it does explicitly associate it with advanced targeting techniques such as environmental keying, where target-specific values can be derived from network shares, physical devices, installed software or versions, files, joined Active Directory domains, system time, and local or external IP addresses to constrain payload decryption and execution. The content also notes that researchers examined possible links between Gauss and Wiper because of overlapping geographic targeting and suspected development relationships among Stuxnet-linked malware families. No specific indicators of compromise for Gauss are provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
First from Flame to Mini-Flame, it’s likely predecessor, and then to Gauss, considered a more widespread successor or perhaps a side operation.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious program identified through code similarity as being from the same group behind Flame.
A modular espionage malware family discussed as a more widespread successor or side operation related to Flame, notable for an encrypted payload that had not been cracked.
A modular malware family discussed as a more widespread successor or side operation related to Flame, notable in the article for its lore around a never-cracked encrypted payload.
Gauss is referenced as an example of malware using environmental keying, deriving decryption keys from target-specific environmental values to constrain execution and evade analysis.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.