Researchers identify Stuxnet-like cyberespionage malware called 'Flame'

28.05.2012

As with Duqu and Stuxnet, it's not clear who created Flame. However the malware's complexity and the amount of resources required to build something like it has led security researchers to believe that it was created or sponsored by a nation state.

Kaspersky's researchers didn't find any evidence that could tie the malware to a specific country or even region. However, there is some text written in English inside the code, Kamluk said.

"Examination of the code also leads Symantec to believe the malware was developed by a natively English speaking set of developers," a Symantec spokesman said via email. "No further observations have been made which could assist in locating the origin of the malware."

Researchers from the Laboratory of Cryptography and System Security (CrySyS) of the Budapest University of Technology and Economics, which played an important role in the discovery and analysis of Duqu, have also on the Flame malware, which they call "sKyWIper."

"The results of our technical analysis support the hypotheses that sKyWIper was developed by a government agency of a nation state with significant budget and effort, and it may be related to cyber warfare activities," the CrySyS researchers said in their report. "sKyWIper is certainly the most sophisticated malware we encountered during our practice;