Loading story…
Kaspersky Lab disclosed Flame (also tracked as Flamer and Skywiper), a large modular espionage platform that infected Windows systems across the Middle East, with the highest known concentration in Iran and additional victims in Israel/Palestine, Sudan, Syria, Lebanon, Saudi Arabia, and Egypt. Researchers and Iranian officials said the malware was built for covert intelligence collection rather than direct disruption, with capabilities including keystroke logging, screenshots, password theft, network sniffing, Skype and instant-message monitoring, audio recording through infected microphones, Bluetooth data collection, and theft of documents and system architecture data. The campaign was described as exceptionally sophisticated, using multiple encryption schemes, forged Microsoft certificates, abuse of Windows Update, USB-based movement, and a modular design that allowed operators to expand surveillance while remaining hidden for years.
Reporting by The Washington Post said U.S. and Israeli officials developed Flame as part of a broader cyber campaign tied to efforts to slow Iran’s nuclear program, alongside operations associated with Stuxnet. Officials and researchers said Flame mapped Iranian networks and exfiltrated intelligence to support sabotage planning, while technical analysis found overlaps with Stuxnet-era tooling even as some experts assessed the malware was built by a parallel team. After public exposure, operators reportedly pushed a kill module to infected systems to remove the malware and overwrite artifacts, complicating forensic investigation and underscoring the operation’s state-grade tradecraft.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
The Washington Post reported, citing Western officials, that the United States and Israel jointly developed Flame as part of a broader cyber campaign against Iran. According to the report, Flame gathered intelligence to support efforts to slow Iran's nuclear program.
By June 2012, researchers had identified code overlap and related technologies connecting Flame with Stuxnet-era malware, though some analysts still believed separate teams may have developed them in parallel. The findings strengthened suspicions of a shared state-sponsored ecosystem behind the campaigns.
In June 2012, Flame's operators instructed infected systems to install a removal component that deleted the malware and overwrote related file locations with random data. The action appeared intended to hinder forensic analysis after public exposure.
Subsequent technical analysis showed Flame abused Microsoft trust mechanisms by using a forged MD5-based certificate to sign malicious code and a module that intercepted Windows Update requests. The finding demonstrated that the campaign could undermine trusted software update channels as part of its espionage operations.
Iranian officials and CERT personnel said Flame had penetrated computers used by high-ranking Iranian officials and called it one of the country's most serious cyber incidents since Stuxnet. They said the malware was built for covert intelligence gathering rather than direct sabotage and that the campaign was still active.
On 2012-05-28, Iran's CERT/MAHER announced it had identified the previously undisclosed Flame malware during investigations tied to Stuxnet and Duqu. MAHER said tested antivirus products were not detecting the malware, so it developed and distributed its own detection tool and prepared a removal utility while assessing Flame as closely related to Stuxnet and Duqu.
Kaspersky Lab publicly revealed Flame in late May 2012 after investigating data-wiping malware in the Middle East at the request of the UN's International Telecommunication Union. Researchers described it as a massive, highly sophisticated cyber-espionage toolkit affecting multiple countries, especially Iran.
Before Flame was publicly identified, Iran detected cyberattacks on its oil industry, an episode later described as part of the context in which the malware surfaced. U.S. and Western officials cited by later reporting said the disruption was directed by Israel in a unilateral operation.
Security researchers later assessed that Flame had been active since at least August 2010, operating as a modular espionage platform across Middle Eastern targets. It was designed for covert intelligence collection, including surveillance, credential theft, and data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
radware.com
Open sourcepcmag.com
Open sourcesecurelist.com
Open sourcewashingtonpost.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026
Escalating conflict following **Operation Epic Fury** (US/Israel strikes inside Iran) has coincided with increased cyber activity targeting Middle East and adjacent interests. Proofpoint reported that Iran-aligned **TA453** (*Charming Kitten / Mint Sandstorm / APT42*) continued intelligence collection during the conflict, including a **credential-phishing** attempt against a US think tank observed on **8 March**, and noted additional campaigns against Middle East government organizations with suspected links to multiple state or state-aligned actors (including suspected attribution to **China, Belarus, Pakistan, and Hamas**). Despite reported Iranian internet shutdown measures after the initial strikes, espionage-focused operations were assessed as ongoing. Check Point Research separately identified China-linked activity targeting **Qatar**, using conflict-themed lures (e.g., fake “war news”/damage imagery) to deliver malware, including **PlugX** and **Cobalt Strike**, with tradecraft described as a multi-stage chain involving a compromised server and **DLL hijacking** via a legitimate application (*Baidu NetDisk*) to load the backdoor—highlighting rapid weaponization of breaking news to target **energy** and **military** sectors. Other items in the set were not part of this conflict-driven espionage theme: one report described a Russian-speaking **‘BlackSanta’** BYOVD-based “EDR killer” delivered via HR workflow abuse and steganographic images, and a weekly threat bulletin summarized unrelated breaches and research (e.g., AkzoNobel, LexisNexis, Wikimedia worm, TriZetto, and AI-related threats).
Jun 29, 2026