This attack campaign was implemented with limited and rudimentary technology, said Costin Raiu, director of Kaspersky Lab's global research and analysis team.

As far as complexity goes, the Mahdi attack would rank lower than the against Tibetan and Uighur activists, Raiu said. At least those campaigns use some type of software exploits to install cyberespionage malware, whereas the Mahdi attackers relied solely on social engineering, he said.

The Mahdi samples analyzed by Seculert and Kaspersky attempted to communicate with four different command and control servers -- three of them located in Canada and one in Iran's capital, Tehran.

There's no definitive proof of the malware's origin yet. However, the presence of a command and control server in Tehran could suggest that the attackers are Iranian, especially since other clues found in the malware indicate that they are fluent in Farsi and use dates in the Persian calendar format, Raff said.

The fact that these attackers managed to infect hundreds of targets despite the simplicity of the techniques used is a bit puzzling, Raiu said. Every serious antivirus product should be able to catch and block this malware, he said.